Is a crypto-asset provider, in the Central African Republic

Règlement n° 03/18/CEMAC/UMAC/CM du 21 décembre 2018 relatif aux conditions d'exercice, de contrôle et de supervision de l'activité des bureaux d'information sur le crédit dans la CEMAC, articles 1, 3, 6, 58, 60 à 66 et 100 à 102 · Read the law's page

• Operate as a credit information bureau only as a licensed legal entity, and supply a client's credit information only for the reasons the Regulation lists.
• As a credit institution or other entity supervised by the banking commission or the central bank, send the licensed bureaus, at least monthly, all credit information on your clients; the clients' prior consent is not required for this.
• As a user of bureau information, obtain the client's prior written consent before consulting the information held on the client, for each credit application and for follow-up of the credit relationship, and keep proof of the consent.
• Guarantee persons whose credit information you hold a right of access and rectification, and tell them the categories of data, the purpose of the collection and the bureau's contact details.
• Do not use bureau information for commercial prospecting, marketing or advertising without the client's prior written consent.
• Do not collect, keep, process or disclose sensitive data in a credit report.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.