São Tomé and Príncipe

ST · STP · Middle East & Africa

1 regulator · 6 laws & regulations · 5 obligations

Obligation	Timing	Regulator	Arises from	Source
NBFC / Non-bank Lending
Microfinance institutions: prior authorisation and annual external audit	Deadline Before starting activity; annual audit	BCSTP	Lei n.º 16/2018 — Regime Jurídico das Microfinanças (Microfinance Legal Regime)	source
Arts. 7 and 9 require prior BCSTP authorisation to be constituted and to operate, with an application fee based on a percentage of share capital. Art. 22 requires accounts to be certified annually and the external audit reports to be sent to the BCSTP.
Payments & Fintech
Authorisation by the BCSTP to provide payment services or operate a payment system	Deadline Before starting activity	BCSTP	Lei n.º 17/2018 — Regime Jurídico do Sistema Nacional de Pagamentos (Legal Regime of the National Payment System)	official
Art. 9 provides that the BCSTP grants authorisation by formal act and may suspend or revoke it; banks already licensed need no new authorisation to provide payment services but do for operating systems. Art. 69 sets rules for e-money issuers: no credit, issue against legal tender or equivalent liquid assets, and redemption at face value on request.
Payment institutions: AML/CFT compliance and five-year record keeping	Retention period At least 5 years (records)	BCSTP	Lei n.º 17/2018 — Regime Jurídico do Sistema Nacional de Pagamentos (Legal Regime of the National Payment System)	official
Art. 17 requires payment service providers to comply with AML/CFT rules and BCSTP standards and makes them fully responsible for those acting for them; Art. 18 requires records to be kept for at least five years from creation, or longer if the BCSTP sets a different period.
Payment service providers: prior notification of outsourcing and registration of agents	Deadline Before outsourcing	BCSTP	Lei n.º 17/2018 — Regime Jurídico do Sistema Nacional de Pagamentos (Legal Regime of the National Payment System)	official
Art. 14 requires operators and providers to notify the BCSTP before outsourcing operational functions, and bars outsourcing that weakens internal control or supervision. Art. 15 requires each agent's details, AML controls and managers to be notified and the agent entered in a public register before it operates; Art. 16 keeps the institution fully liable for third parties. No cloud-specific rule was found.
No obligations match these filters.