Africa Fintech Regulatory Atlas

Country compliance guides for fintechs operating in Africa

Each guide covers one market's rules for a fintech: who is in scope, the regulators, the obligations with their legal sources, the evidence that shows each one is met, and a dated timeline. Every legal statement is recorded in a public source ledger and checked against the official text before publication.

The guides are general information, not legal advice. We are remote-first; we work with local counsel and advisory partners. Read how we research and label content in our editorial policy.

Published guides

• Egypt

  Personal Data Protection Law (Law 151 of 2020) and its 2025 Executive Regulations

  Who is in scope after the Central Bank carve-out, PDPC licences and permits, the 72-hour breach rule, and the grace period ending on or around 1 November 2026.

  Last reviewed 11 October 2026

• Egypt

  FinTech Law 5/2022 and the FRA decrees for non-bank fintechs

  FRA licensing and approval, Decree 227 cybersecurity and penetration testing, Decree 140 digital identity, Decree 186 customer verification, and the outsourcing and risk-scoring vendor registers.

  Last reviewed 11 October 2026

• Kenya

  AML/CFT under FATF increased monitoring, the VASP Act 2025 and the Data Protection Act

  Who is a reporting institution, the two-day suspicious transaction clock, the 2023 AML Regulations, ODPC registration for financial services, and the 72-hour breach rule.

  Last reviewed 11 October 2026

• South Africa

  POPIA, the FIC Act and Joint Standard 2 after the FATF grey list

  Which fintechs are accountable institutions, the suspicious, cash and cross-border reporting clocks, POPIA breach reporting through the eServices portal, and the cybersecurity Joint Standard in force since June 2025.

  Last reviewed 11 October 2026

• Ghana

  The Bank of Ghana Cyber Directive, Act 843 and AML rules

  The March 2026 Cyber and Information Security Directive (CISO approval, ISO 27001 and PCI DSS, monthly incident returns), DPC registration and breach duties, 24-hour AML reporting, and digital credit and virtual asset licensing.

  Last reviewed 12 October 2026

FATF grey list tracker: African jurisdictions

As of the FATF plenary statement of 19 June 2026 · checked 12 October 2026

Sourced The Financial Action Task Force (FATF) lists jurisdictions under increased monitoring, often called the grey list. A listing means the country has committed to fix identified strategic deficiencies in its anti-money-laundering and counter-terrorist-financing regime within agreed timeframes. The FATF says it does not call for enhanced due diligence on these jurisdictions, and that its standards call for a risk-based approach rather than cutting off entire classes of customers. Source: FATF, Jurisdictions under Increased Monitoring, 19 June 2026.

African jurisdictions under FATF increased monitoring, as of 19 June 2026

Jurisdiction	Committed since	Status in the June 2026 statement
Angola	October 2024	Working through its action plan.
Cameroon	June 2023	All action-plan deadlines have expired and work remains.
Côte d'Ivoire	October 2024	Judged in June 2026 to have substantially completed its action plan; an on-site assessment comes next.
Democratic Republic of the Congo	October 2022	Judged in June 2026 to have substantially completed its action plan; an on-site assessment comes next.
Kenya	February 2024	Working through its action plan.
South Sudan	June 2021	Working through its action plan.

Recently removed from increased monitoring: Algeria (June 2026), Namibia (June 2026), Burkina Faso (October 2025), Mozambique (October 2025), Nigeria (October 2025) and South Africa (October 2025). Egypt, Ghana, Nigeria, Tanzania and Uganda are not on the 19 June 2026 list. The full list, including jurisdictions outside Africa, is in the FATF statement; see also the June 2026 plenary outcomes and the October 2025 statement, which removed Burkina Faso, Mozambique, Nigeria and South Africa.

StackWeaver view A listing is about a country's regime, not about any firm in it. In practice, fintechs in a listed country should expect banking partners and investors to ask more questions about their own controls, so it helps to have the evidence ready: customer due diligence records, suspicious transaction reports, sanctions screening and a current risk assessment. Our evidence readiness assessment is a readiness review of that evidence, not an audit; audit readiness for fintechs explains what to have ready.

Every statement in this tracker is recorded in a public source ledger and checked automatically against the FATF text. We update it after each FATF plenary. Compiled by the StackWeaver compliance research team. AI tools helped research and draft it; the source checks are automated, and it has not yet had a named reviewer's sign-off.

In preparation

Uganda and Tanzania are next. We publish a country only when its claims pass our source checks. Nigerian rules are covered in our guides to the NDPA and CBN AML/CFT.