Uganda UG

Globally, virtual-asset regulatory architecture is moving toward frameworks combining licensing, client-asset protection and Travel-Rule AML controls; in Uganda, the directly relevant development is the Financial Intelligence Authority's first national ML/TF risk assessment on virtual assets, completed in September 2025, which found roughly $564 million in virtual-asset inflows and roughly $546 million in outflows between July 2020 and June 2024. Stablecoins were the largest single component of this flow, and the assessment characterises the great majority of this activity as sitting largely outside regulatory oversight. This is the first time Uganda's own financial-intelligence apparatus has quantified and formally named virtual-asset flow as a national money-laundering and terrorist-financing risk, rather than treating it as an informally understood phenomenon.

The Bank of Uganda has responded by announcing a six-pillar virtual-asset regulatory framework: licensing and fit-and-proper requirements, client-asset protection, AML/CFT controls including the Travel Rule, cybersecurity standards, market-integrity provisions and transparency obligations. This framework remains at the announced-pillars stage, with no published draft bill as of this cycle, and the expected timeline for a more concrete instrument points toward 2027. The gap between this design-stage position and the position of regional peers, several of which have already enacted dedicated virtual-asset service provider statutes, is a structural feature of Uganda's current exposure rather than a one-off delay.

A separate but related development this cycle is judicial: Uganda's High Court upheld Bank of Uganda Circular NPSD 306 (issued 29 April 2022) in Silver Kayondo v Bank of Uganda, confirming that entities licensed under the National Payment Systems Act may not convert virtual assets into official currency or mobile money. This ruling closes off judicial uncertainty about whether the circular's restriction was validly imposed, and it means that, for as long as no comprehensive VASP framework exists, licensed payment rails in Uganda remain formally closed to direct crypto-to-fiat conversion. The effect is that whatever volume the FIA's assessment measured moved through channels other than regulated payment-system operators, a detail with direct bearing on how any future six-pillar framework would need to address the cash-out point specifically.

Taken together, these three facts describe a jurisdiction where the scale of the digital-asset risk has now been measured, the direction of regulatory travel has been announced, but the substantive licensing and supervisory apparatus to address the measured risk is not yet in force. The size of the gap between measurement and regulation is itself the D5 finding for this cycle.

Outlook

The primary marker to watch is whether the six-pillar framework progresses beyond announced pillars into a published draft bill, given the multi-year uncertainty band the regulatory horizon currently carries. A second marker is whether the FIA's full national risk-assessment document becomes independently available, since this cycle's flow figures rest on secondary press reporting of the assessment rather than the primary document itself. Until a licensing framework exists, the structural gap the assessment identified is likely to persist as the defining D5 fact for Uganda.

Globally, AML/CTF architecture is increasingly organised around FATF-tiered monitoring status and sector-by-sector accountable-person perimeters; in Uganda, this cycle's directly relevant development is confirmation that the country remains off the FATF increased-monitoring list, having been removed in February 2024, with the June 2026 plenary listing continuing to exclude Uganda from that list. ESAAMLG's follow-up mutual-evaluation process rates Uganda Compliant or Largely Compliant on 25 of the FATF's 40 Recommendations, a standing baseline position that frames the country's overall AML architecture as functioning at a level the FATF process itself regards as adequate, even as sector-specific gaps persist elsewhere in the regime.

The more immediately consequential D7 development this cycle is sectoral rather than status-level: the National Lotteries and Gaming Regulatory Board has, as a condition of the 2026 casino licence-renewal cycle, required casinos to register as accountable persons with the Financial Intelligence Authority and to submit annual AML/CFT compliance reports. This closes a supervisory gap in a sector, gambling, that in many jurisdictions sits formally within AML coverage but has historically received limited effective supervision in practice. Tying the registration requirement to the licence-renewal process itself gives the obligation direct regulatory teeth: a casino that fails to register or report risks its licensing status, not merely a standalone AML penalty.

This sectoral tightening should be read against the standing FATF/ESAAMLG baseline rather than as a signal of broader deterioration. Uganda's overall AML architecture is stable and rated adequately by the mutual-evaluation process; what has moved this cycle is the extension of accountable-person obligations into a previously under-supervised sector, which represents an incremental strengthening of coverage rather than a response to an identified deficiency in the existing framework.

Outlook

The standing FATF/ESAAMLG position is not expected to change materially before the next onsite or plenary cycle, anticipated in 2028 or 2029. The more immediate marker to watch is implementation: whether casino operators actually complete FIA accountable-person registration and file the required annual compliance reports within the 2026 renewal cycle, and whether the Financial Intelligence Authority publishes any compliance data on gambling-sector registration uptake in subsequent cycles.