Republic of the Congo

Single-licence regulation for credit institutions in the CEMAC, listed on the COBAC regulations page and announced by a BEAC press release dated 14 February 2025. The PDF text was not read.

Assigns national anti-corruption policy to the HALC (Art. 6), requires banks and financial institutions to report relevant facts to it (Art. 119) and sets criminal penalties for bribery, embezzlement, illicit enrichment and money laundering. Arts. 91-112 protect whistleblowers, witnesses and experts, including a ban on dismissal for reporting (Art. 107).

Makes the national information systems security agency the central body. Operators must notify attacks and intrusions to the agency without delay (Art. 18), manage security risks (Art. 22), keep connection and traffic data for ten years (Arts. 21, 25). Systems of public bodies undergo mandatory periodic security audits by experts the agency approves (Arts. 12-16). Cryptology providers need declaration or approval.

Sets consent, notice and data-subject rights (access, objection, portability, rectification and deletion) and requires breach notification to the Commission within 72 hours where possible. The Commission may issue warnings and fines of 1,000,000 to 100,000,000 CFA francs.

Regional regulation on payment services, listed on the BEAC payment-systems page and the COBAC regulations page. The PDF has no machine-readable text, so licensing and safeguarding provisions were not read. No sandbox or separate fintech text appears on those pages.

Regional regulation on payment systems, payment instruments and payment incidents, listed on the BEAC payment-systems page; the PDF text was not read.

COBAC regulation requiring credit institutions to draw up business continuity plans, per the COBAC regulations page. The PDF text was not read.

Insurance code applicable in CIMA member states, whose list on the CIMA site includes Congo; published on the CIMA website as an HTML edition (edition date not shown).