Cameroon Fintech Compliance Guide 2026, BEAC/CEMAC, Circular No. 000002 & AML Steps for Payment Startups

This Cameroon fintech compliance guide 2026 is a practical playbook for payment startups, e-money issuers and payment service providers (PSPs) operating in, or entering, the Cameroon and broader CEMAC market. The regulatory environment has shifted materially: Circular No. 000002, dated 19 February 2026, introduced dematerialisation and e-procurement obligations for certain financial flows, while the Bank of Central African States (BEAC) and the Banking Commission of Central Africa (COBAC) continue to tighten licensing enforcement and anti-money-laundering (AML) scrutiny across the six-nation zone. Fintech regulation in Cameroon 2026 now demands that operators act immediately or risk sanctions, licence delays and exclusion from critical payment corridors.

Executive Summary, What Changed and What to Do Now

Payment startups must act now. The convergence of new BEAC/CEMAC fintech rules, the dematerialisation mandate under Circular No. 000002 2026, and heightened FATF/GABAC pressure on AML controls means that compliance is no longer a future aspiration, it is an operational prerequisite. Below is a concise summary of what changed and the immediate priorities every fintech operator should address in the next 30 to 60 days.

What changed, key dates and documents:

• Circular No. 000002 (19 February 2026). Mandates dematerialisation of procurement-related financial flows, imposing new system, audit trail and record-retention requirements on PSPs, banks and government counterparties.
• BEAC/CEMAC renewed payment-services directives (2024–2026). Updated licensing categories for payment institutions and e-money issuers, with stricter capital and governance thresholds.
• FATF/GABAC mutual evaluation follow-up. Cameroon remains under enhanced scrutiny, increasing AML/KYC enforcement expectations for all regulated financial actors, including fintechs.
• COBAC supervisory intensification. On-site inspections and desk-based reviews of digital financial service providers have accelerated across the CEMAC zone.

Immediate action plan, 30 to 60 day priorities:

• Map every payment flow and transaction type affected by Circular No. 000002’s dematerialisation requirements.
• Confirm your current licensing status with BEAC, verify whether your activities fall under PSP, e-money issuer or payment institution categories.
• Update AML/KYC policies and risk assessments to reflect 2026 GABAC/ANIF expectations.
• Conduct a gap analysis of your transaction-monitoring and suspicious-transaction-reporting (STR) capabilities.
• Engage qualified Cameroonian legal counsel to prepare or review licence applications and compliance documentation.

Regulatory Landscape: BEAC, CEMAC, COBAC and National Authorities, Understanding BEAC CEMAC Fintech Rules

Understanding who regulates fintech in Cameroon is the essential first step for any compliance programme. Cameroon’s fintech sector operates within a layered regulatory architecture that combines supranational CEMAC-zone institutions with national enforcement bodies. The BEAC CEMAC fintech rules establish the overarching framework, while local authorities handle day-to-day supervision and AML enforcement.

BEAC and CEMAC, Remit and Recent 2024–2026 Directives

The Banque des États de l’Afrique Centrale (BEAC) is the central bank for all six CEMAC member states, Cameroon, Chad, Central African Republic, Republic of Congo, Equatorial Guinea and Gabon. BEAC holds primary regulatory authority over payment systems, payment service providers and electronic money issuers across the zone. Its foundational regulation governing payment services, available on the BEAC website, sets out licensing categories, prudential requirements and operational standards that apply uniformly throughout CEMAC.

Between 2024 and 2026, BEAC has issued a series of updated directives that tighten governance standards for digital payment operators. These directives raise minimum capital requirements, impose enhanced reporting obligations and introduce specific technology-infrastructure standards for entities handling electronic payments. Circular No. 000002 (19 February 2026) represents the most recent, and most operationally significant, of these instruments, extending dematerialisation obligations to e-procurement flows involving financial institutions and PSPs.

COBAC, The Banking Supervisor’s Enforcement Role

The Commission Bancaire de l’Afrique Centrale (COBAC) serves as the banking and financial supervisor for the CEMAC zone. While BEAC sets the regulatory framework, COBAC enforces it. COBAC conducts on-site inspections, reviews licence applications, monitors prudential compliance and has the authority to impose sanctions, including fines, activity restrictions and licence revocations, on non-compliant institutions. Industry observers expect COBAC’s inspection programme for digital financial service providers to intensify throughout 2026.

National Bodies, Ministry of Finance, GABAC and ANIF

At the national level, Cameroon’s Ministry of Finance (Ministère des Finances) exercises oversight of financial services and coordinates with BEAC and COBAC on licensing matters. For AML and counter-terrorism financing (CTF), the key institutions are the Groupe d’Action contre le Blanchiment d’Argent en Afrique Centrale (GABAC), the CEMAC-wide FATF-style regional body, and the Agence Nationale d’Investigation Financière (ANIF), Cameroon’s national financial intelligence unit. ANIF receives and analyses suspicious transaction reports (STRs) and currency transaction reports (CTRs) from all obligated entities, including fintechs. The practical effect is that payment startups must satisfy both the supranational BEAC/COBAC framework and the national AML reporting expectations set by ANIF.

Circular No. 000002 (19 February 2026), Dematerialisation and E-Procurement Requirements

Circular No. 000002 2026 is the single most consequential recent change for payment operators in Cameroon. Issued on 19 February 2026, it mandates the dematerialisation of certain procurement-related financial flows, effectively requiring that specific transaction categories, invoicing processes and payment records be processed, transmitted and stored in fully electronic formats.

Summary of Requirements

The circular establishes several core obligations for entities within its scope:

• Electronic processing. All procurement-related payment instructions, invoices and supporting documents must be generated, transmitted and received through approved electronic systems, paper-based parallel processes are no longer compliant for in-scope transactions.
• Audit trail obligations. Entities must maintain comprehensive, tamper-evident digital audit trails for every dematerialised transaction, from initiation through to settlement and reconciliation.
• System and infrastructure standards. Payment systems used to process dematerialised flows must meet minimum technical standards for data integrity, encryption, access controls and uptime.
• Record retention. Digital records of all dematerialised transactions must be retained for the period prescribed by the circular, with the ability to produce them for inspection by COBAC or other supervisory authorities on request.

Which Entities Are in Scope

The dematerialisation requirements under Circular No. 000002 apply broadly across the financial ecosystem. Based on reporting from local legal commentators, the following entities are directly affected:

• Payment service providers (PSPs), any entity authorised by BEAC to provide payment initiation, processing or settlement services.
• Banks and credit institutions, traditional financial institutions handling procurement-related payments.
• Government counterparties, public entities contracting with private-sector suppliers where payments flow through regulated channels.
• Marketplace platforms and aggregators, digital platforms that intermediate procurement transactions between buyers and sellers and route payments through licensed PSPs.

Implementation Timeline and Enforcement Expectations

The circular took effect on its publication date of 19 February 2026. Early indications suggest that COBAC will adopt a phased enforcement approach, prioritising the largest institutions and highest-volume transaction corridors first before extending scrutiny to smaller PSPs and fintech operators. However, all in-scope entities are expected to demonstrate good-faith compliance efforts immediately, including documented gap analyses, remediation plans and board-level accountability for implementation.

Compliance checklist for Circular No. 000002:

• Identify all procurement-related payment flows currently processed by your platform.
• Assess whether your current systems meet the circular’s electronic-processing and data-integrity standards.
• Implement or upgrade audit-trail functionality to produce tamper-evident records.
• Establish a record-retention policy and technical infrastructure aligned with the prescribed retention periods.
• Designate a compliance officer responsible for dematerialisation and schedule regular internal reviews.
• Document your compliance programme and be prepared to present it to COBAC on request.

Licensing and Market Access for Payment Service Providers, Cameroon Fintech Compliance Guide 2026

Obtaining a payment service provider licence in Cameroon is not optional, it is a legal prerequisite for any entity offering payment initiation, processing, e-money issuance or related services within the CEMAC zone. The BEAC regulation governing payment services establishes three primary licence categories, each with distinct requirements and supervisory expectations.

Licence Types Under the CEMAC Framework

• Payment Institution (Établissement de Paiement). Authorised to provide payment services, transfers, payment initiation, account information services, without issuing electronic money. This is the most common licence category for fintech startups focused on payments infrastructure.
• Electronic Money Issuer (Émetteur de Monnaie Électronique). Authorised to issue, distribute and manage electronic money stored on prepaid instruments or digital wallets. Mobile-money operators and wallet-based fintechs typically require this licence.
• Payment Service Provider (PSP, broader category). A general designation that may encompass payment institutions and e-money issuers as well as entities providing ancillary payment services such as payment aggregation or gateway services, depending on the scope of activities.

Step-by-Step Application Process

Licence application, typical requirements and timeframes:

Regulatory Sandbox and Pilot Options

The concept of a regulatory sandbox in Cameroon and the broader CEMAC zone is still evolving. BEAC has signalled openness to supervised pilot programmes for innovative payment products, but a formal, publicly documented sandbox framework comparable to those in the UK or Singapore does not yet exist. The likely practical approach for startups is to engage directly with BEAC and the national Ministry of Finance to propose a controlled pilot, defining transaction limits, geographic scope, customer protections and reporting obligations in advance. Demonstrating a proactive compliance posture during the pilot phase significantly improves the prospects of a full licence application being approved.

AML, KYC and CDD Expectations for Fintech Operators, AML KYC Fintech Cameroon

Anti-money-laundering and know-your-customer obligations represent one of the highest-risk compliance areas for fintechs operating in Cameroon. The country’s AML framework is shaped by FATF recommendations, GABAC regional standards and national legislation enforced by ANIF. With Cameroon continuing to face enhanced scrutiny in FATF/GABAC mutual evaluations, regulators expect fintechs to implement robust, risk-based AML/KYC programmes, not merely tick-box exercises.

2026 AML Priorities, FATF Signals and GABAC/ANIF Expectations

The Financial Action Task Force continues to monitor the CEMAC region’s progress on addressing strategic AML/CTF deficiencies. For Cameroon specifically, the 2026 priorities centre on three areas: improving the volume and quality of STR filings from non-bank financial institutions (including fintechs), strengthening beneficial-ownership transparency and enhancing cross-border payment monitoring. GABAC has reinforced these priorities at the regional level, and ANIF is expected to increase outreach and enforcement actions targeting digital financial service providers.

Practical KYC and Enhanced Due Diligence Controls for Digital Onboarding

Fintechs operating digital onboarding processes must implement KYC controls that are both effective and proportionate to risk. The following minimum standards apply:

• Customer identification. Collect and verify full legal name, date of birth, nationality, residential address and a government-issued identity document (national ID card, passport) for all customers.
• Electronic identity verification (e-ID). Where available, use electronic verification services to cross-check customer data against government databases or trusted third-party providers.
• Know-your-business (KYB). For business customers, verify legal registration, ownership structure, beneficial owners (individuals holding 25% or more), directors and authorised signatories.
• Enhanced due diligence (EDD). Apply EDD to politically exposed persons (PEPs), high-risk jurisdictions, complex ownership structures and unusually large or frequent transactions.
• Sanctions screening. Screen all customers and counterparties against applicable sanctions lists, including UN, EU, OFAC and any CEMAC/GABAC-specific lists, at onboarding and on an ongoing basis.

Transaction Monitoring, STR/CTR Reporting and Record Retention

All licensed fintechs are obligated to implement continuous transaction monitoring capable of detecting suspicious patterns. Key obligations include:

• Suspicious transaction reports (STRs). Filed with ANIF immediately upon detection of a transaction that raises suspicion of money laundering, terrorism financing or other financial crime.
• Currency transaction reports (CTRs). Filed for transactions exceeding prescribed thresholds, typically on a periodic basis (monthly or quarterly aggregates).
• Record retention. All customer identification records, transaction data and internal compliance reports must be retained for a minimum of ten years from the date of the transaction or the end of the customer relationship, whichever is later.

Sanctions and Correspondent Banking Risks

Fintechs that facilitate cross-border payments or maintain correspondent banking relationships face additional screening obligations. Sanctions-screening tools must be updated at least daily, and any matches, including partial or fuzzy matches, must be investigated and resolved before the transaction is processed. Failure to maintain adequate sanctions controls can result in loss of correspondent banking access, which effectively cuts off a fintech’s ability to process international payments.

Reporting Obligations by Entity Type

Operational Controls and Technology Implications

Meeting the requirements of this Cameroon fintech compliance guide 2026 is not solely a legal exercise, it demands operational and technical investment. Payment startups must build compliance into their technology stack from the outset rather than retrofitting controls after a regulatory demand.

Dematerialisation and E-Procurement Compliance: Data Formats, Audit Trails and Invoice Handling

Entities affected by Circular No. 000002 must ensure their systems can generate, transmit and store dematerialised records in standardised data formats acceptable to BEAC and COBAC. Practical requirements include:

• Structured data formats. Invoices, payment instructions and reconciliation reports should be generated in machine-readable formats (XML, JSON or structured PDF/A) rather than scanned images of paper documents.
• Tamper-evident audit trails. Every transaction must generate a time-stamped, sequentially numbered audit record that cannot be altered without detection. Hash-chain or blockchain-style logging can satisfy this requirement.
• Automated reconciliation. Systems should support automated matching of payment instructions against invoices and delivery confirmations to reduce error and fraud risk.
• Access controls. Strict role-based access controls must govern who can create, approve and modify dematerialised records, with full logging of all user actions.

Data Protection and Cross-Border Data Transfer

While Cameroon does not have a comprehensive data-protection statute fully equivalent to the EU’s GDPR, the CEMAC region has taken steps towards harmonising data-protection principles for financial services. Fintechs should exercise caution when transferring customer data across borders, particularly to jurisdictions outside the CEMAC zone. Industry observers expect that BEAC will issue further guidance on data-localisation requirements for payment data in the near term. In the meantime, the prudent approach is to store primary customer and transaction data on servers located within the CEMAC zone and to conduct privacy impact assessments before deploying any cross-border data flows.

Incident Response and Reporting Obligations

All licensed fintechs must maintain an incident-response plan that addresses cybersecurity breaches, system outages and data-integrity failures. Key requirements include:

• Notification timeline. Report significant operational incidents to BEAC and COBAC within the prescribed timeframe (industry observers expect this to be within 24 to 72 hours of detection, depending on severity).
• Root-cause analysis. Conduct and document a thorough root-cause analysis for every material incident.
• Customer notification. Where customer data or funds are affected, notify impacted customers promptly and provide remediation steps.
• Vendor due diligence. Maintain documented due diligence on all third-party technology vendors, including cloud-service providers, payment-processing partners and e-ID verification services. Review vendor security certifications, data-handling policies and business-continuity arrangements at least annually.

Enforcement Risk, Penalties and Practical Remediation Steps

Understanding the enforcement landscape is critical for calibrating your compliance investment. COBAC has the authority to impose a graduated range of sanctions on non-compliant institutions, and the likely practical effect of 2026 regulatory changes is increased enforcement activity targeting digital financial service providers.

Likely Enforcement Scenarios

Enforcement actions can be triggered by scheduled inspections, thematic reviews, STR deficiencies flagged by ANIF or complaints from consumers or other regulated entities. The most common scenarios include desk-based reviews of submitted compliance documentation, on-site inspections of operational premises and technology systems, and targeted investigations following specific intelligence or complaints.

Remediation Checklist and Engagement Strategy

If your organisation identifies compliance gaps, or is notified of a pending regulatory inquiry, the following remediation steps should be implemented immediately:

• Engage qualified legal counsel experienced in CEMAC financial regulation.
• Conduct an internal audit to identify and document all deficiencies.
• Prepare a written remediation plan with clear timelines and accountable individuals.
• Communicate proactively with COBAC or BEAC, voluntary self-disclosure of issues and remediation progress is viewed favourably.
• Implement corrective measures and document evidence of completion.

Practical Compliance Playbook, 90-Day, 6-Month and 12-Month Roadmap

Translating regulatory requirements into a structured implementation programme is essential. The following roadmap provides a phased approach to achieving full compliance with the current BEAC CEMAC fintech rules.

90-Day Checklist (Immediate Priorities)

• Appoint or confirm a Chief Compliance Officer with board-level reporting authority.
• Complete a comprehensive regulatory-mapping exercise (licence status, Circular No. 000002 scope, AML/KYC gaps).
• Submit or update your BEAC licence application (if not yet filed or if activities have expanded).
• Update AML/KYC policies and procedures to reflect 2026 GABAC/ANIF expectations.
• Implement or upgrade transaction-monitoring systems with Cameroon-appropriate alert thresholds.
• Conduct initial staff training on STR identification and filing procedures.
• Begin technical assessment for dematerialisation compliance (audit trails, data formats, record retention).

6-Month Roadmap

• Complete system upgrades for Circular No. 000002 compliance (e-procurement data formats, tamper-evident audit trails).
• Conduct a full vendor due-diligence review for all third-party technology and payment partners.
• Perform an independent AML/KYC effectiveness review (internal audit or external consultant).
• Establish a regular compliance-reporting cadence to the board (quarterly at minimum).
• Test and document your incident-response plan through a tabletop exercise.

12-Month Programme

• Complete the first annual AML risk assessment aligned with FATF/GABAC methodology.
• Undergo an independent external audit of compliance controls and remediate any findings.
• Review and update all contractual arrangements with payment partners to include compliance obligations.
• Prepare for a potential COBAC on-site inspection, ensure all documentation is current and accessible.

Compliance Governance, Who Owns What Inside a Fintech

• Board of Directors. Ultimate accountability for compliance culture and risk appetite; approves the compliance framework and risk-assessment methodology.
• Chief Compliance Officer (CCO). Day-to-day oversight of all regulatory obligations; reports directly to the board; serves as primary point of contact with BEAC, COBAC and ANIF.
• Money Laundering Reporting Officer (MLRO). Responsible for STR/CTR decisions and filings with ANIF; may be the same person as the CCO in smaller organisations.
• Chief Technology Officer (CTO). Owns the technical implementation of dematerialisation, audit-trail and data-integrity requirements; manages vendor due diligence for technology partners.
• Head of Operations. Ensures customer-facing processes (onboarding, transaction processing) align with compliance policies; manages staff training.

Sample contractual clause for payment-partner agreements:

“Each Party shall maintain at all times such licences, authorisations and approvals as are required under applicable BEAC/CEMAC regulations and Cameroonian law for the conduct of its activities under this Agreement, including compliance with Circular No. 000002 (19 February 2026) and all applicable AML/CTF legislation. Each Party shall promptly notify the other of any material change to its regulatory status.”

Sample AML policy headings (minimum coverage):

• Customer acceptance policy and risk classification
• KYC/CDD and EDD procedures
• Transaction-monitoring rules and alert-escalation protocol
• STR identification, investigation and ANIF filing

  Need Legal Advice?

  This article was produced by Global Law Experts. For specialist advice on this topic, contact Ntuiabane Ogork Ntui at Ogork and Partners, a member of the Global Law Experts network.