Ghana has moved from legislation to implementation. Less than three months after President John Dramani Mahama signed the Virtual Asset Service Providers (VASP) Act into law, the country’s Securities and Exchange Commission (SEC) has admitted eleven companies to a formal regulatory sandbox — the first operational test of Ghana’s new crypto licensing architecture.
The eleven firms will spend up to twelve months testing their products under live regulatory oversight, with full licences available after six months if they satisfy compliance criteria. For West Africa, the admission list is a signal: regulated crypto infrastructure is being built, firm by firm, rule by rule.
Who Got In
The SEC has admitted a cross-section of the digital asset value chain — not just exchanges, but tokenisation platforms, custody providers, and payment systems.
Exchanges (5 firms): Hyro Exchange GH Ltd, Hanypay, HSB Global, Koinkoin, and WhiteBits will test crypto trading operations under supervised conditions.
Asset Tokenisation (3 firms): Vaulta, XChain, and Bsystem Ltd will focus on fractionalising global assets — turning traditionally illiquid holdings into tradable digital units on distributed ledgers.
Commodity Tokenisation (1 firm): Africoin will test the tokenisation of gold — a significant bet in a country that ranks among Africa’s top gold producers.
Payment Tokenisation (1 firm): Blu Penguin will test tokenised payment systems, targeting the digital payments gap that still characterises much of West Africa’s commerce.
Custody Services (1 firm): Goldbod will provide custody for gold-backed securities — a niche at the intersection of commodity finance and digital asset infrastructure.
The mix is deliberate. The SEC is not merely licensing spot exchanges; it is building out the full stack of services needed for a functioning digital asset market.
The Regulatory Architecture
The sandbox operates under the Securities Industry (Regulatory Sandbox Licensing) Guidelines 2026, issued March 9 — superseding rules that dated to 2020. For the first time, those guidelines create a dedicated Virtual Asset Sandbox Track, covering crypto, tokenisation, distributed ledger technology, and — notably — decentralised autonomous organisations (DAOs).
The Act itself, formally designated Act 1154, divides oversight between two regulators: the SEC governs virtual asset exchanges and tokenisation platforms, while the Bank of Ghana retains responsibility for financial stability and payment-related virtual assets. This dual-regulator model mirrors approaches seen in the United Kingdom’s Financial Conduct Authority / Prudential Regulation Authority split and Singapore’s Monetary Authority.
Under the joint oversight framework, a Virtual Assets Regulatory Office (VARO) operates within the Bank of Ghana, providing a coordinated supervisory layer across both regulators. This architecture is designed to prevent the regulatory gaps that have allowed offshore platforms to dominate African markets with minimal compliance obligations.
What the Sandbox Rules Actually Require
The 2026 sandbox guidelines make explicit which requirements are flexible and which are not — a degree of transparency uncommon in African regulatory frameworks.
Temporarily relaxed for sandbox participants:
- Minimum paid-up capital
- Capital adequacy thresholds
- Board composition requirements
- Licence fees
Non-negotiable, regardless of sandbox status:
- AML/CFT compliance — Know Your Customer, transaction monitoring, and suspicious activity reporting remain fully in force
- Customer data confidentiality
- Fit-and-proper criteria — particularly on honesty and integrity of officers
- Handling of client money and assets
Foreign VASPs admitted to the sandbox face additional requirements: a physical office in Ghana and at least one Ghana-resident senior officer or compliance officer for the duration of testing. This “boots on the ground” requirement is a direct response to the enforcement difficulties that have plagued offshore platform regulation across sub-Saharan Africa.
Incident reporting timelines are tight. Material incidents — cyberattacks, data breaches, operational disruptions, fraud events — must reach the SEC within 24 hours. Material governance changes require notification within seven days.
The West African Stakes
Ghana’s move is not occurring in isolation. Sub-Saharan Africa’s crypto transaction flows exceeded $200 billion in the past twelve months, much of it running through unregulated or grey-zone channels. Ghana, Nigeria, Kenya, and South Africa now form the regulatory frontier.
Nigeria’s response has been notably different. President Bola Tinubu endorsed a Virtual Asset Regulatory Authority (VARA) White Paper in December 2025, but the framework relies on existing agency mandates — the Central Bank of Nigeria, the Securities and Exchange Commission, and the Nigeria Revenue Service — rather than creating a single licensing window. The CBN has paused new crypto sandbox admissions while the VARA architecture is finalised.
The divergence matters for regional capital flows. As Ghana activates a structured pathway to full VASP licences, West African crypto operators face a choice: set up under Ghanaian regulatory supervision or remain in the grey zone and risk enforcement under whichever framework eventually dominates the region.
Kenya’s VASP Bill, passed by parliament in October 2025, established the Capital Markets Authority as the licensing authority for exchanges — a third model. ECOWAS-level harmonisation remains aspirational; the current reality is three separate West/East African regulatory architectures emerging simultaneously.
What Sandbox Participants Need to Know
For companies already operating in the West African digital asset space — or considering entry — the practical implications are clear:
AML/CFT is the floor, not the ceiling. The sandbox reduces capital and structural barriers to entry, but compliance obligations on financial crime are the same as for fully licenced institutions. Firms testing products in Ghana must have their AML/CFT infrastructure operational before they begin.
Gold-backed and commodity tokenisation is a distinct track. Two of the eleven admitted firms — Africoin and Goldbod — are specifically targeting gold. Ghana’s regulatory framework is one of the few on the continent that explicitly contemplates commodity tokenisation, creating a potential hub for this asset class.
The six-month checkpoint is critical. Sandbox participants who satisfy compliance criteria at the six-month mark can apply for full licences. Those who do not risk being removed from the sandbox and losing their market position to faster-moving competitors.
Cross-border operations require separate strategies. Full VASP licences in Ghana do not passport into Nigeria, Kenya, or any other African jurisdiction. Firms aiming for continent-wide operations must navigate each country’s framework separately — or wait for regional harmonisation that may be years away.
Regulatory Timeline
| Date | Event |
|---|---|
| December 2025 | VASP Act 2025 (Act 1154) signed by President Mahama |
| Early 2026 | Bank of Ghana and SEC begin joint oversight |
| March 9, 2026 | SEC issues updated Sandbox Licensing Guidelines 2026 |
| March 10–11, 2026 | 11 firms admitted to sandbox |
| September 2026 (est.) | Six-month compliance checkpoint; full licence applications open |
| March 2027 (est.) | Twelve-month sandbox period ends; full regulatory framework expected operational |
Bottom Line
Ghana has done what many African governments have promised and few have delivered: moved from crypto legalisation to active regulatory implementation in under three months. The eleven firms now in the sandbox are building the operational precedent for what licenced digital asset businesses in West Africa look like.
The test will be in execution. AML/CFT requirements are non-negotiable, incident reporting is tight, and foreign firms must maintain a physical presence. For serious operators, the path to a full licence is visible. For those hoping Ghana’s regulatory enthusiasm would translate into light-touch oversight, the 2026 guidelines provide a clear answer: it will not.
BETAR.africa covers business, technology, and regulation across the African continent. This article draws on SEC Ghana regulatory filings, the VASP Act 2025 (Act 1154), and reporting by TechCabal and BitKE.
UphivaBETAR
