When African heads of state gathered in Addis Ababa for the 38th African Union Assembly Summit in February 2025, the adoption of eight technical Annexes to the AfCFTA Protocol on Digital Trade passed without the fanfare it deserved. Combined with the Protocol itself — adopted at the 37th AU Assembly Summit in February 2024 — the completion of that full legal framework marked the most consequential moment in African digital commerce since the continental free trade area came into force. For Africa’s technology companies, the clock is now running.
A Framework Built for the Digital Economy
The Protocol on Digital Trade is the AfCFTA’s answer to a fundamental problem: the continent’s 54 countries have built 54 different digital economies, each with its own rules on contracts, data, payments, and taxation. Cross-border digital commerce — selling software, providing cloud services, processing payments across borders — has meant navigating a patchwork of incompatible legal regimes. The Protocol and its eight Annexes are designed to end that fragmentation.
The Protocol will enter into force once 22 AfCFTA State Parties have ratified it — a threshold that mirrors the minimum required to activate the main AfCFTA agreement itself. From ratification, each state then has five years to implement the Protocol’s obligations domestically. That timeline sounds generous, but it compresses rapidly when measured against the pace of African legislative reform. Companies that treat ratification as a future problem will find themselves unprepared when markets open faster than anticipated in their key territories.
The eight Annexes adopted in February 2025 complete the Protocol’s architecture: Rules of Origin; Digital Identities; Cross-Border Digital Payments; Cross-Border Data Transfers; Source Code Disclosure; Online Safety and Security; Emerging Technologies (covering artificial intelligence and blockchain); and Financial Technology. Each Annex carries binding obligations once a state ratifies. Together, they represent the most comprehensive continental digital trade rulebook ever attempted.
The Ownership Threshold That Will Catch Founders Off Guard
The Protocol’s most immediately disruptive provision for African tech companies is also its least discussed: the Rules of Origin requirement. To receive preferential treatment under the Protocol — including duty-free access to digital products across State Party markets — a company’s digital product must originate from an entity that is more than 50 percent beneficially owned by nationals of AfCFTA State Parties.
For founders who bootstrapped their companies or raised early capital domestically, this is straightforward. For the cohort of African startups that secured venture capital from international funds — and that cohort represents a substantial share of the continent’s highest-profile technology companies — the calculus is more complicated. A Nairobi-based fintech that raised Series A and Series B rounds from US or European venture capital firms may already sit below the 50 percent beneficial ownership threshold by the time those rounds are accounted for. That company would not, on current terms, qualify for Protocol preferences.
This is not a hypothetical concern. The VC funding model that has driven African tech growth over the past decade systematically transfers beneficial ownership to foreign investors at scale. Founders and legal counsel should conduct ownership structure analyses now, before ratification, while there is still time to consider restructuring options that preserve AfCFTA eligibility without compromising access to international capital markets.
Data Governance: A Framework That Leaves Room for National Rules
The Cross-Border Data Transfers Annex establishes a framework built on four lawful bases for moving personal data across borders: consent; contractual performance; direct benefit to the data subject; and public interest. This mirrors approaches familiar from the EU’s General Data Protection Regulation but is calibrated for an African context where regulatory capacity varies enormously across states.
Critically, the Protocol does not mandate data localization — a relief for cloud companies and data-intensive startups that have watched data localization requirements proliferate across individual African jurisdictions. However, the Protocol explicitly preserves public policy exceptions, meaning states retain the right to impose localization requirements where they can justify them on public interest grounds. The practical effect is that localization risk has been reduced but not eliminated, and companies operating across multiple AfCFTA states should map existing and proposed localization requirements in their key markets as part of compliance planning.
The Emerging Technologies Annex, which covers artificial intelligence and blockchain, represents a framework in early formation rather than a settled rulebook. Regulatory coordination on AI governance is explicitly anticipated but the substantive standards remain underdeveloped — a gap that creates both flexibility and uncertainty for African AI companies trying to structure products for continental scale.
Fintech’s Passporting Moment
For the fintech sector, the Financial Technology Annex carries the most transformative potential. The Annex creates the conditions for pan-African payment passporting — a mechanism by which a payment services company licensed in one AfCFTA State Party could operate across other State Party markets without obtaining full domestic licensing in each jurisdiction. For companies in the Flutterwave class — those building payment infrastructure designed to work across African markets — this could fundamentally alter the economics of continental expansion.
Currently, a company expanding payment operations across ten African markets faces ten separate regulatory processes, each with its own capital requirements, compliance frameworks, and approval timelines. Passporting collapses that cost structure. The May 2025 inaugural AfCFTA Digital Trade Forum in Lusaka, which launched a 13-point implementation plan, identified cross-border digital payments as a priority workstream — a signal that the payments infrastructure is among the first areas where practical implementation progress is expected.
The December 2025 Tenth Committee on Digital Trade meeting in Nairobi advanced working sessions on payments, data, and digital identity — the three pillars on which fintech passporting ultimately depends. Progress is real, if incremental.
Taxation: Clarity on Duties, Continued Fragmentation on DSTs
The Protocol draws a clear line on customs duties: digital products traded between State Parties are to be duty-free. This aligns the AfCFTA framework with the WTO moratorium on customs duties on electronic transmissions — a moratorium that, as of this writing, faces a March 2026 expiry deadline at the multilateral level. Should the WTO moratorium lapse without renewal, the AfCFTA Protocol’s duty-free commitment for State Party trade would remain in place as a regional backstop, though non-State Party trade flows would face a changed environment.
What the Protocol does not do is harmonize digital services taxes. National DSTs — levied by countries including Kenya, Nigeria, and Zimbabwe at rates and on bases that differ significantly — remain outside the Protocol’s scope. African tech companies with multi-market revenue streams should not expect the Protocol to simplify their DST compliance obligations in the near term.
The Integration Dividend — and the Work Required to Claim It
The OECD’s INDIGO-t index projects that full implementation of the AfCFTA Digital Trade Protocol could produce a 313 percent improvement in digital trade integration across the continent. That figure captures the scale of what is at stake. It also implicitly captures how far the continent currently is from realizing it. Full implementation, across 22 or more ratifying states, with five-year domestic implementation timelines, is a decade-long project at minimum.
For African tech founders, investors, and policy professionals, the pre-ratification period is not a waiting room — it is the most strategically important phase of the Protocol’s lifecycle. Founders should audit their beneficial ownership structures against the Rules of Origin threshold before investor negotiations crystallize further. Legal teams should map data transfer flows against the four lawful bases in the Cross-Border Data Transfers Annex and assess exposure to national localization exceptions. Fintech companies should engage directly with the AfCFTA Secretariat’s payment workstreams, because the passporting architecture being built now will reflect the interests of those who participate in building it. And every company with continental ambitions should understand that the 22-ratification threshold, once crossed, will trigger implementation timelines that compress the preparation window sharply. The Protocol’s legal framework is complete. The companies that understand it now will be positioned to move the moment the market opens.
Joseph Busari
UphivaBETAR
