São Tomé and Príncipe

Approved by the Assembleia Nacional on 20 March 2025, promulgated on 22 May 2025 and published in the Diário da República, I Série, No. 28, on 5 June 2025. Art. 5 sets price stability as the main objective, Art. 34(1) gives the bank exclusive authority to regulate, license, register and supervise financial institutions and apply administrative sanctions, and Art. 6(1)(e) covers regulation and oversight of payment systems. It repeals Lei n.º 08/92 (Art. 97). The text does not mention insurance or AML provisions.

Approved by the Assembleia Nacional on 31 August 2018, promulgated on 16 November 2018 and published in the Diário da República, I Série, No. 22, on 11 April 2019 (the DGRN legislation list calls it Decreto-Lei n.º 6/2019, the text itself says Lei n.º 6/2019). It has no whistleblowing channel but protects workers against abusive sanctions after legitimate complaints (Arts. 104(a), 116-117), and names the Inspecção-Geral do Trabalho for several filings. Entry into force is 90 days after publication (Art. 6).

Passed 29 June 2018, promulgated 15 August 2018 and published in the Diário da República No. 130 on 3 September 2018; it takes effect 30 days after publication (Art. 28). Microfinance activity needs prior BCSTP authorisation (Arts. 7, 9), the BCSTP supervises it (Art. 20), institutions must have their accounts certified annually by an external audit (Art. 22), and the Financial Institutions Law sanction regime applies (Art. 25). Microinsurance companies are among the institutions covered (Arts. 2, 4).

Published in the Diário da República No. 133 on 7 September 2018. The BCSTP authorises payment service providers and system operators by formal act and may suspend or revoke the authorisation (Arts. 4, 9); operators and providers must notify the BCSTP before outsourcing (Art. 14) and agents must be registered before operating (Art. 15); institutions stay fully liable for staff, agents and outsourcers (Art. 16). It also sets AML/CFT duties (Art. 17), record keeping for at least five years (Art. 18), electronic money rules (Art. 69) and fines (Arts. 21, 31). No explicit rule on segregating customer funds was found in the text read.

Approved 15 February 2016, promulgated 18 March 2016 and published in the Diário da República No. 39 on 10 May 2016. It sets consent and lawful-basis rules (Arts. 6-7), information duties (Art. 10), data subject rights (Arts. 11-14), security measures (Arts. 15-16), transfer rules (Arts. 19-20) and fines (Arts. 31-35). It contains no general breach notification duty.

BCSTP rule issued on 31 December 2009 and in force from 1 January 2010; it revokes NAP 4/2008. It sets separate minimum capital for commercial banks, development or investment banks and banks that do both, requires a three-year business plan and risk and systems information, and gives the BCSTP 90 days from a complete application to decide, first by preliminary and then by definitive authorisation. Foreign branches are limited to banks rated A or higher.