RegTech in Cameroon: the compliance landscape

What is regulatory technology?

Regulatory technology — regtech — is the use of software to meet regulatory obligations and to prove they have been met: identifying customers, screening transactions, filing the reports a supervisor requires, protecting the data a law protects, and keeping records an auditor can verify years later. This page is about regtech in Cameroon — the regulatory stack an institution here actually answers to, what that stack demands in practice, and the honest state of the technology being built to serve it.

The term entered common use in 2015, when the United Kingdom’s Financial Conduct Authority opened a call for input on supporting the development and adoption of regtech; in its 2016 feedback statement, the regulator described regtech as a sub-set of fintech focused on technologies that may facilitate the delivery of regulatory requirements more efficiently and effectively than existing capabilities. Its mirror image is suptech — the use of technology by supervisory authorities themselves, for data collection, reporting pipelines, and analysis — whose adoption among early-user supervisory agencies the Bank for International Settlements has documented. The two meet in the middle: a regulated institution’s systems produce what a supervisor’s systems consume.

A definition only matters once it survives contact with a particular jurisdiction. What follows maps the regulators and legal instruments that compliance technology must serve in Cameroon and the CEMAC zone — each carried with a citation to a primary or authoritative source — because the useful question is never “what is regtech?” in the abstract. It is: regulated by whom, reporting what, to which authority, under which law?

The regulatory stack in Cameroon and CEMAC

An institution operating in Cameroon answers to several layers of regulation at once: a supranational monetary and prudential layer shared with five other states, a regional anti-money-laundering regime plugged into the FATF’s global network, a continental body of harmonized business law, and a national layer covering financial intelligence, cybersecurity, data protection, and public integrity. The table gives the map; the next section walks the territory.

The layers, one by one

At the monetary core sits the Bank of Central African States (BEAC), the central bank shared by the six CEMAC members — Cameroon, the Central African Republic, Chad, the Republic of the Congo, Equatorial Guinea, and Gabon. BEAC conducts the union’s monetary policy, issues its currency, and runs the payment and settlement systems through which every regulated financial flow ultimately moves. Prudential supervision belongs to the Central African Banking Commission (COBAC), created by convention in 1990 and chaired by the BEAC Governor: it supervises credit institutions and microfinance institutions across the union. The practical consequence for regtech is easy to miss — a bank in Douala or Buea complies with a regional prudential rulebook, and reporting technology has to speak the supervisor’s language, not merely the national one.

The anti-money-laundering layer is regional as well. GABAC — the Action Group against Money Laundering in Central Africa — is a specialized CEMAC institution established in 2000 and part of the FATF’s global network of regional bodies; it promotes AML/CFT standards and conducts mutual evaluations of its member states, Cameroon included. The operative instrument is CEMAC Regulation No. 01/CEMAC/UMAC/CM of 11 April 2016 on the prevention and repression of money laundering, terrorist financing and proliferation, revised on 20 December 2024 by Regulation No. 02/24/CEMAC/UMAC/CM — a revision that, among other changes, brings virtual assets and their service providers into scope and widens the range of professions bound by due-diligence and reporting duties. The national end of the chain is ANIF, the National Financial Investigation Agency — Cameroon’s financial intelligence unit, created by Decree No. 2005/187 of 31 May 2005 and attached to the Ministry of Finance. Regulated professions file suspicious-transaction reports to ANIF; ANIF analyses and enriches them; substantiated cases are referred for prosecution.

One fact sharpens all of the above. Since 23 June 2023, Cameroon has featured on the FATF’s list of jurisdictions under increased monitoring — commonly called the grey list — following a high-level political commitment to work with the FATF and GABAC on strengthening its AML/CFT regime; the June 2026 FATF statement records continued progress, with work remaining. A grey-listing changes the texture of compliance: obligations no longer merely need to be met, they need to be demonstrably met, on timelines watched from outside. That is, precisely, an engineering problem.

Company and commercial law is continental. Cameroon is one of the seventeen member states of OHADA, the Organisation for the Harmonization of Business Law in Africa, created by the Treaty of Port-Louis in 1993 and headquartered in Yaoundé. OHADA legislates through Uniform Acts that apply directly and identically in every member state — from commercial companies to secured transactions, insolvency, and arbitration — so the legal form, governance, and filings of a Cameroonian company are defined by harmonized regional law. For compliance systems this is quietly good news: model the OHADA layer once and it holds across seventeen jurisdictions.

The digital layer is national. ANTIC, the National Agency for Information and Communication Technologies, carries the security mandate under Law No. 2010/012 of 21 December 2010 on cybersecurity and cybercriminality: security of electronic communications networks and information systems, security audits, and electronic certification. And with Law No. 2024/017 of 23 December 2024, Cameroon adopted a general personal-data-protection law, providing for a supervisory authority and a scale of administrative, civil, and criminal sanctions. Between the two, how an institution secures its systems and handles personal data is no longer an internal preference; it is regulated conduct — the terrain of governed cybersecurity.

Finally, the integrity institutions. CONAC, the National Anti-Corruption Commission, was created by Decree No. 2006/088 of 11 March 2006 and placed under the authority of the President of the Republic; ARMP, the Public Procurement Regulatory Agency, regulates the public-procurement system, publishes notices and awards, examines complaints, and audits procedures. Neither is a financial-sector supervisor, but together they define the accountability environment around public money — the environment APEX, our anti-corruption intelligence system for public procurement, is designed to serve.

What the stack asks of an institution

Read as one obligation set, the layers translate into recurring, verifiable duties. Know who your customer is, and be able to show how you know. Screen names and transactions, and keep the evidence of the screening. File suspicious-transaction reports to ANIF, prudential returns to COBAC, and whatever the supervisory authority provided for by the 2024 data-protection law comes to require. Pass a security audit without a month of preparation theatre. Honour a data subject’s rights when they are exercised. Every one of these duties is simultaneously a data problem — is the record complete and current? — and an evidence problem — can a third party verify it without taking your word?

Regtech’s claim, made carefully, is that such duties are better discharged by systems than by heroics — and best discharged by systems designed for them from the start. Compliance-by-design means the control lives inside the architecture rather than in a procedures manual: a report that assembles itself from records that were trustworthy when they were written; an audit that reads tamper-evident logs instead of reconstructing memories; a deletion right honoured by how the storage was built, not by a promise appended to it. The alternative — manual assembly at each deadline — does not merely cost more; it produces evidence a supervisor has to take on faith.

For institutions whose product is a public record — registries, certifying agencies, supervisory bodies — the bar rises again. We call systems built for that bar registry-grade: records that are append-only, so history cannot be silently rewritten; audit trails that are tamper-evident, so every consequential action is attributable; cryptographic keys held by the institution, never the vendor; data resident on national infrastructure; and exports to open standards, so the data outlives any single supplier. That discipline is the subject of our sovereign governance infrastructure page, and it is the discipline institutions in a closely watched jurisdiction will increasingly be asked to show — not asserted, but proven.

Where SIGIL fits

SIGIL SARL — Sovereign Integrity Governance Infrastructure Labs — is a Cameroonian regtech and govtech company, founded in 2023 and based in Buea (RCCM RC.BUA.2026.B.0190), that builds registry-grade systems for public institutions, aligned to international standards. One rule runs through the company and the systems themselves: the institution holds the keys; the data stays under the institution’s control; every consequential action is authorized, bounded, and proven.

Three systems carry that rule. VIGIL is a governed cybersecurity and evidence platform for duly authorized operators, built to OWASP, MITRE ATT&CK, and NIST 800-115 discipline, in which a technical capability is never an authorization and no finding is trusted until independently re-verified. RÉCOR is a sovereign beneficial-ownership registry designed for Cameroon, built to satisfy FATF Recommendations 24 and 25 — the international standard requiring adequate, accurate, and up-to-date beneficial-ownership information — and to export to the Beneficial Ownership Data Standard (BODS) v0.4, an open format any compatible tool can read. APEX is an anti-corruption intelligence system for public procurement, aligned to UNCAC and the Open Contracting Data Standard, in which no single person can escalate a case and every finding is independently verifiable.

All three systems are pre-deployment. SIGIL has no customers, deployments, pilots, or partnerships to cite, and this page cites none. What the record does hold: RÉCOR was fully demonstrated to, and acknowledged by, Open Ownership on 1 July 2026 — this is a technical demonstration, not an endorsement; in 2026, UNDP Cameroon issued a letter of appreciation; and APME, the Small and Medium Enterprises Promotion Agency, invited SIGIL to present to its digitalization unit. Everything else is design, and is stated as design.

Regtech is one face of this work. Where the institution being served is the state itself — its agencies, its records, its public-facing systems — the same architecture reads as govtech, and that side of the landscape is mapped on our govtech Cameroon hub.

Regtech in Cameroon: a category still being built

It would flatter no one to pretend Cameroon has a mature regtech industry. It does not. The demand side is real and documented above — layered, supranational, and under active international scrutiny. The domestic supply side is young: much compliance work inside institutions remains manual, and there is no established roster of local regtech vendors for this page to point to. Where the category is thin, saying so plainly is worth more than a brochure that implies otherwise.

The conditions for the category to form are nonetheless legible: one prudential rulebook across six states, an active FATF-network evaluator in GABAC, a new data-protection law with an authority to enforce it, and a compliance environment in which proof now matters more than assertion. When a Cameroonian regtech industry is measured, it will be measured the way the field is measured everywhere — by whether the system can prove what it claims. That is the standard SIGIL was founded to meet, and this page will be updated as the landscape changes. Institutions that wish to examine the architecture can write to info@sigilsovereign.com.

Frequently asked

Request a briefing →

Related reading