Uganda Cryptocurrency Regulation: VASP Rules, AML and the 2026 Regulatory Gap

Uganda does not yet have a comprehensive law governing virtual assets. That gap is becoming harder to ignore.

In February 2026, the Financial Intelligence Authority published Uganda’s first national risk assessment focused specifically on virtual assets and virtual asset service providers.

The assessment identifies regulatory and operational gaps. It also calls for stronger supervision, better monitoring tools and a more complete legal framework.

Uganda is already dealing with crypto businesses. It is also applying anti-money-laundering rules to them. The central question in 2026 is how the country will regulate them.

Uganda Does Not Yet Have a Comprehensive VASP Law

Uganda’s regulatory position is unusual. Virtual assets are not covered by a single comprehensive licensing regime.

Uganda’s first national virtual-asset risk assessment describes the sector as having regulatory gaps. It calls for a stronger legal and institutional framework.

That means a business cannot simply point to a Uganda VASP licence and assume that the wider regulatory question has been settled. Different laws can still apply to particular activities.

While Uganda is still developing its centralized oversight frameworks, neighboring markets have already finalized rigid compliance criteria; see our detailed breakdown of Kenya's cryptocurrency regulatory guidelines to compare regional capital requirements

But Crypto Businesses Are Not Outside the Law

The absence of a dedicated VASP licensing regime does not mean the country has no rules for Uganda crypto businesses.

Uganda amended the Second Schedule to the Anti-Money Laundering Act in 2019. Virtual Asset Service Providers were added to the list of accountable persons. FIA then began registering VASPs for AML and counter-terrorist-financing purposes.

This distinction is important. FIA registration is not the same as a comprehensive VASP operating licence. It places a business inside Uganda’s AML framework.

A Major Regulatory Change Arrived in 2026

On 13 February 2026, FIA announced an amendment to the Second Schedule of the Anti-Money Laundering Act. It said all VASPs must comply with the AML Act, its regulations and relevant FIA guidelines.

The authority also required affected VASPs to register with FIA as accountable persons within 30 days from publication of the instrument in the National Gazette.

The change gives the AML obligation a current enforcement pathway. Crypto businesses cannot rely on the absence of a dedicated VASP statute as a reason to ignore AML duties. ## Uganda’s First Dedicated Crypto Risk Assessment

Uganda’s first dedicated virtual-asset risk assessment is one of the most important regulatory developments of 2026.

FIA says the assessment identifies threats, vulnerabilities and emerging trends. It also identifies gaps in Uganda’s legal and institutional framework.

The report is also a policy tool. It gives authorities a national evidence base for future legislation.

Uganda no longer has to design crypto rules without a formal assessment of the sector’s risks. Future regulation can build on documented market activity.

Uganda’s Crypto Market Has Meaningful Activity

The regulatory gap exists alongside significant cryptocurrency activity. The national risk assessment recorded $564 million in virtual-asset inflows and $546 million in outflows between July 2020 and June 2024. That represents more than $1.1 billion in combined flows.

The market is also unusually decentralised.

Bank of Uganda Deputy Governor Michael Atingi-Ego said 84.5% of Uganda's virtual-asset activity occurs on decentralised platforms. The Sub-Saharan African average was 63.8%.

That creates a difficult regulatory problem. Uganda is trying to build oversight around a market where much of the activity does not pass through conventional centralised intermediaries.

The Shift Toward DeFi Raises a Regulatory Problem

FIA’s assessment highlights a change in Uganda’s crypto activity.

Centralised services gained traction until 2022. Their use then declined. DeFi activity became more prominent. FIA says this shift can make AML and counter-terrorist-financing controls harder to apply.

The deeper problem is identification. A conventional exchange can identify customers. It can monitor transactions. It can file suspicious transaction reports.

A decentralised protocol may not have the same central operator. Regulation built around licensed intermediaries may not map neatly onto DeFi.

What Does FIA Registration Mean?

FIA’s AML framework requires accountable persons to maintain an AML programme. It includes internal controls, a compliance function and staff training.

Customer due diligence is also required. Higher-risk relationships can require enhanced due diligence. FIA guidance covers transaction monitoring, record keeping and reporting.

These requirements apply to crypto businesses within the AML framework. They do not amount to a full VASP prudential licence.

The Register Shows a Live Market

FIA maintains a public register of accountable persons. It includes businesses classified as VASPs.

The register is evidence of formal AML registration. It should not be read as a complete list of every crypto business operating in Uganda.

It also shows why the phrase “unregulated crypto market” needs qualification. Uganda lacks comprehensive VASP regulation. But crypto businesses are already subject to AML registration and reporting duties.

Banking Relationships Add Another Layer

Crypto regulation is not only about licences. It is also about access to the formal financial system.

Uganda’s risk assessment refers to a shadow financial system created by restrictions on virtual-asset transactions in the formal financial sector. It warns that this can push activity toward less visible channels.

That creates a difficult balance. Banks need to manage financial-crime risk. Crypto companies need reliable financial access. Regulators need enough information to supervise the market.

A clearer framework could reduce some of this uncertainty. Banks would still need to assess individual customers and transactions.

Consumer Protection Remains a Gap

AML rules do not answer every consumer question. A broader VASP regime could address custody, disclosure, conflicts of interest and customer-asset protection.

Uganda’s current AML-focused approach does not provide the same comprehensive consumer-protection structure as a full virtual-asset licensing regime. That matters when users face fraud, poor custody practices, market manipulation or platform failures.

What a Future Uganda VASP Framework Could Address

Uganda has not yet completed a comprehensive VASP regime. Detailed licensing requirements should therefore be treated as a future policy question.

A future framework could address licensing, governance, customer protection, custody, market conduct, capital requirements and technology controls. It could also clarify which authority supervises each activity.

That matters because crypto platforms can combine several functions. Clear boundaries would help businesses understand which rules apply to each service.

What the Current Position Means for Crypto Businesses

Uganda does not yet have a comprehensive VASP licensing regime. VASPs are subject to AML obligations. Affected VASPs must register with FIA as accountable persons.

FIA maintains a public register of accountable persons. Uganda has completed its first dedicated virtual-asset risk assessment. A broader regulatory framework remains a policy priority.

Businesses therefore face a regulatory environment that is developing rather than settled.

Uganda Is Moving Toward Regulation

The policy direction is becoming clearer. FIA is building supervisory capacity. VASPs are being brought into the AML framework. A national risk assessment has been completed.

The country has not yet completed the broader legal framework needed for comprehensive VASP supervision. Uganda is therefore in an intermediate stage.

Crypto activity is established. AML oversight is expanding. Full market regulation is still developing.

Why the Regulatory Gap Matters

Uganda’s experience shows why crypto regulation cannot be reduced to whether cryptocurrency is legal.

The harder questions concern businesses. Who can operate an exchange? Who can custody customer assets? Who supervises stablecoin activity? What protections apply when a platform fails?

Uganda has started answering some of these questions through AML rules. It has not yet answered all of them through a comprehensive VASP law. That distinction will matter as the market grows.

Uganda Crypto Regulation: Key Facts

• 2019 — VASPs were added to Uganda’s AML framework as accountable persons.
• 34th — Uganda’s position in the 2024 virtual-asset adoption ranking cited by FIA.
• 18th — Uganda’s 2024 P2P exchange trade-volume ranking cited by FIA.
• 12th — Uganda’s 2024 DeFi value-received ranking cited by FIA.
• February 2026 — FIA published Uganda’s first dedicated virtual-asset national risk assessment.
• 30 days — registration period stated by FIA for affected VASPs after publication of the 2026 amendment instrument.