Cambodia FinTech Regulation: Complete Licensing and Compliance Framework

Cambodia's financial regulatory architecture is anchored by the National Bank of Cambodia (NBC), which serves as both the central bank and the primary prudential regulator for banks, microfinance institutions, and payment service providers. The NBC's regulatory authority derives from the Law on the Organization and Conduct of the National Bank of Cambodia (1996, amended 2023) and the Banking and Financial Institutions Law (1999, amended 2023). For fintech companies, the most relevant regulatory instruments are Prakas (ministerial orders) issued by the NBC Governor. Beyond the NBC, fintech companies must engage with multiple regulatory bodies depending on their activities. The General Department of Taxation (GDT) under the Ministry of Economy and Finance oversees tax registration, CamInvoice compliance, and withholding tax obligations. The Securities and Exchange Regulator of Cambodia (SERC) regulates securities-related fintech activities including equity crowdfunding and digital asset trading. The Insurance Regulator of Cambodia (IRC) supervises insurtech companies offering digital insurance products. The Cambodia Financial Intelligence Unit (CAFIU) under the NBC receives and analyzes suspicious transaction reports.

The NBC's Prakas on Payment Service Providers (B7-019-344) establishes three categories of payment service licenses, each with distinct scope, capital requirements, and operational constraints. Category 1 licenses authorize the issuance and management of electronic money (e-wallets). Category 2 licenses cover payment processing, aggregation, and gateway services. Category 3 licenses permit money transfer services, including domestic and international remittance. Category 1 (E-Money Issuance) is the most capital-intensive, requiring minimum registered capital of KHR 2 billion (approximately USD 500,000) and full segregation of customer funds in trust accounts at NBC-licensed banks. E-money issuers must maintain a 1:1 reserve ratio, meaning every unit of e-money outstanding must be backed by an equivalent amount in the trust account. Category 2 (Payment Processing) requires KHR 1 billion (approximately USD 250,000) in registered capital and is commonly used by payment aggregators, POS terminal providers, and online payment gateways. Category 3 (Money Transfer) requires KHR 1.5 billion (approximately USD 375,000) and imposes additional KYC requirements for cross-border remittance services. All three categories require the applicant to demonstrate robust technology infrastructure, disaster recovery capabilities, data residency within Cambodia, and compliance with NBC's information security standards. Determining the correct licence category before drafting is what prevents a re-filing.

Beyond minimum registered capital, NBC-licensed fintech companies face ongoing financial obligations designed to ensure solvency and protect consumer funds. All PSP licensees must maintain a capital adequacy ratio (CAR) of at least 15% of risk-weighted assets, calculated quarterly and reported to the NBC. E-money issuers (Category 1) must additionally maintain a liquidity coverage ratio ensuring they can meet all customer redemption requests within 24 hours. Operational expenses coverage is another key requirement: PSP licensees must demonstrate that their capital base covers at least 6 months of projected operating expenses at all times. If capital falls below this threshold, the NBC issues a supervisory warning and may restrict new customer onboarding until capital is restored. Annual license renewal fees range from KHR 10 million to KHR 50 million depending on the license category and transaction volume. Fintech companies raising capital from foreign investors must comply with the Foreign Investment Law and register their investment with the Council for the Development of Cambodia (CDC). Investment incentives, including tax holidays of up to 6 years and duty-free import of equipment, are available for qualified investment projects. Capital raises can be structured to capture CDC investment incentives while still meeting NBC capital requirements.

Cambodia's AML/CFT framework is governed by the Law on Anti-Money Laundering and Combating the Financing of Terrorism (2020, amended 2023), which transposes the Financial Action Task Force (FATF) Forty Recommendations into Cambodian law. The NBC enforces AML/CFT compliance for all financial institutions and PSPs through detailed Prakas specifying customer due diligence (CDD), record-keeping, suspicious transaction reporting (STR), and sanctions screening requirements. Fintech companies must implement a risk-based approach to AML/CFT, conducting customer risk assessments at onboarding and periodically thereafter. Standard CDD requires verification of customer identity using government-issued documents (national ID, passport) and collection of address, occupation, and source of funds information. Enhanced Due Diligence (EDD) is mandatory for politically exposed persons (PEPs), high-risk jurisdictions (FATF grey/black list countries), and transactions above KHR 40 million (approximately USD 10,000). Simplified Due Diligence (SDD) is permitted for low-risk, low-value products up to KHR 4 million (approximately USD 1,000). Under Article 12 of the AML/CFT Law, a reporting entity that suspects funds are the proceeds of an offence or are related to terrorist financing must report to CAFIU promptly and within 24 hours; cash transactions above USD 10,000, including connected transactions reaching that total, are separately reportable. The NBC requires all PSPs to implement automated transaction monitoring systems that flag unusual patterns, including structuring (splitting transactions to avoid thresholds), rapid movement of funds, and transactions involving high-risk jurisdictions. Intentional failure to file a required report carries imprisonment of one month to one year and a fine of KHR 50 million to KHR 200 million for a natural person, and a fine of KHR 200 million to KHR 500 million for a legal entity.

The NBC's Prakas on Technology Risk Management (B7-020-275) establishes mandatory cybersecurity and technology governance standards for all financial institutions and PSPs. The requirements cover seven domains: IT governance, information security management, cybersecurity operations, data management, technology project management, IT outsourcing, and business continuity planning. Fintech companies must appoint a Chief Information Security Officer (CISO) or equivalent role, conduct annual penetration testing by qualified third parties, implement Security Information and Event Management (SIEM) systems for real-time threat monitoring, and maintain a cyber incident response plan tested through tabletop exercises at least annually. Data must be encrypted at rest (AES-256 or equivalent) and in transit (TLS 1.2+). Multi-factor authentication is mandatory for all administrative access to payment systems. Data residency requirements mandate that all customer data and transaction records be stored on servers physically located within Cambodia. Cloud computing is permitted only if the cloud provider operates a data center within Cambodia or the NBC grants a specific exemption (which is rarely issued). This requirement has significant implications for fintech companies that rely on global cloud providers, as it typically necessitates either a dedicated in-country deployment or partnership with a local hosting provider. The NBC conducts on-site technology inspections as part of the licensing process and periodically during the license term. Findings from these inspections must be remediated within 30 days for critical issues and 90 days for non-critical issues.

All NBC-licensed fintech companies must register with the GDT and comply with Cambodia's tax obligations, including corporate income tax (standard rate 20%), value-added tax (10% on taxable supplies), withholding taxes on payments to non-residents (14% on services, 4% on interest), and monthly tax on salaries. Financial services are generally exempt from VAT, but payment processing fees, technology service charges, and consulting fees are taxable. The mandatory CamInvoice e-invoicing system adds a significant compliance layer. All invoices issued by fintech companies to merchants, banks, or enterprises must be submitted to CamInvoice in real-time UBL 2.1 format. This includes service fee invoices, technology licensing fees, and any other B2B charges. The CamInvoice API validates each invoice against GDT business rules and returns a digital tax stamp confirming registration. Invoices without valid CamInvoice stamps are not deductible for the buyer's corporate income tax purposes, creating strong economic incentives for compliance. The GDT has allocated specific Taxpayer Identification Number (TIN) ranges for NBC-licensed PSPs, enabling automated cross-referencing between NBC licensing records and GDT tax filings. Tax compliance, CamInvoice billing integration, and GDT audit readiness are best scoped as one programme.

Digital lending has emerged as one of Cambodia's fastest-growing fintech segments, prompting the NBC to issue specific guidance on technology-enabled credit products. The Prakas on Lending by Technology (2023) establishes that any entity providing credit through digital channels must hold either a banking license, a microfinance institution (MFI) license, or a specific digital lending endorsement on a PSP license. Unlicensed digital lending is explicitly prohibited and actively enforced. Digital lenders must comply with the NBC's consumer protection requirements, including clear disclosure of all fees and interest rates in annualized percentage rate (APR) format, a mandatory 7-day cooling-off period for first-time borrowers, prohibition of predatory collection practices, and maximum interest rate caps set at 18% per annum for secured loans and 36% per annum for unsecured microloans. The NBC has banned aggressive marketing of credit products via SMS or social media to individuals who have not explicitly opted in. Credit scoring models used by digital lenders must be registered with the NBC and subject to periodic review for fairness and accuracy. The NBC requires that borrowers be informed of the factors that contributed to their credit decision. Alternative data sources (mobile usage patterns, social media activity, e-commerce transaction history) may be used in credit scoring but must be validated against repayment performance data and must not discriminate based on protected characteristics. Digital lending startups face three gates: NBC licensing, credit model registration, and consumer protection compliance.

The NBC launched its Regulatory Sandbox in 2023, providing a structured environment for fintech companies to test innovative products and services under regulatory supervision before seeking full licensing. The sandbox allows up to 12 months of testing with a defined scope, limited customer base (maximum 5,000 users), and reduced capital requirements (50% of standard minimums). Successful sandbox graduates receive expedited licensing review. To enter the sandbox, applicants must submit a detailed proposal describing the innovative product, target market, technology architecture, risk mitigation measures, and consumer protection safeguards. The NBC evaluates proposals based on genuine innovation (not replication of existing services), potential benefit to financial inclusion, and the applicant's technical and managerial capability. As of Q4 2025, the NBC has admitted 8 companies to the sandbox, with 5 successfully graduating to full licenses. The sandbox is particularly relevant for fintech models that do not fit neatly into existing license categories, such as decentralized finance (DeFi) applications built on Bakong infrastructure, AI-powered robo-advisory services, open banking data aggregation platforms, and blockchain-based trade finance solutions. A sandbox application has to demonstrate genuine innovation while addressing the NBC's risk and consumer protection concerns.

Cambodia's foreign exchange regime is relatively liberal compared to regional peers, with no restrictions on current account transactions and limited capital account controls. However, fintech companies dealing in cross-border payments and foreign exchange must comply with specific NBC regulations. The Prakas on Foreign Exchange Reporting requires all transactions above USD 10,000 to be reported to the NBC's Statistics Department. Money transfer operators (Category 3 PSPs) must report all cross-border remittances regardless of amount. The NBC's de-dollarization policy, which aims to increase Khmer Riel usage from approximately 20% to 30% of total money supply by 2030, has regulatory implications for fintech companies. New PSP licenses now require the ability to process both KHR and USD transactions, and the NBC encourages (but does not yet mandate) default pricing in KHR. The Reserve Requirement Regulation imposes higher reserve ratios for USD deposits (12.5%) compared to KHR deposits (7.0%), creating a cost incentive for financial institutions to promote Riel-denominated products. For cross-border payment corridors, fintech companies must obtain specific NBC endorsement on their PSP license and comply with bilateral regulatory agreements between Cambodia and the partner country. The Thailand-Cambodia (Bakong-PromptPay) corridor requires compliance with both NBC and Bank of Thailand regulations. Cross-border payment services carry the most complex regulatory requirements of any category here.

The NBC's consumer protection framework for fintech has strengthened significantly with the 2024 Prakas on Financial Consumer Protection. Key provisions include mandatory transparent disclosure of all fees, charges, and terms in both English and Khmer before customer enrollment, prohibition of auto-enrollment in premium services, requirement for explicit opt-in consent for data sharing with third parties, and a standardized complaint handling process with resolution timelines. Fintech companies must establish internal complaint handling units that acknowledge customer complaints within 24 hours and resolve them within 15 business days. If the customer is not satisfied with the resolution, they may escalate to the NBC's Financial Consumer Protection Unit, which mediates disputes and can impose corrective actions on the fintech company. Persistent consumer protection violations result in supervisory warnings, public disclosure, and potential license conditions. Data privacy obligations are governed by the Draft Personal Data Protection Law (expected passage in 2026), which will introduce GDPR-style provisions including purpose limitation, data minimization, right to access, right to erasure, and mandatory data protection officer appointment for companies processing data of more than 10,000 individuals. Fintech companies should begin preparing for these requirements now, as the law is expected to take effect with a 12-month transition period after passage.

For fintech companies planning to enter the Cambodian market, a structured compliance roadmap is advisable that sequences regulatory approvals to minimize time-to-market while ensuring full legal compliance. The roadmap typically spans 9-18 months from initial planning to first customer transaction. Phase 1 (Months 1-3) covers market assessment and regulatory strategy, including determination of the appropriate license category, capital structuring, and engagement with NBC for preliminary consultations. Phase 2 (Months 3-6) involves company incorporation with the Ministry of Commerce, GDT tax registration, capital injection, office establishment, and key personnel recruitment (including mandatory positions such as compliance officer and CISO). Phase 3 (Months 6-12) covers NBC license application submission, technology infrastructure deployment in Cambodia, AML/CFT policy development, and sandbox participation if applicable. Phase 4 (Months 12-15) addresses NBC on-site inspection, remediation of any findings, and final license approval. Phase 5 (Months 15-18) covers Bakong integration, KHQR merchant onboarding, CamInvoice integration, and commercial launch. Sequencing the five phases correctly is the single largest determinant of total approval time. The avoidable delays are nearly always the same two: submitting before the application is genuinely complete, and treating AML/CFT policy as a document to be produced at the end rather than a programme that has to exist and be evidenced. Both are within the applicant's control, and both are cheaper to get right in Phase 2 than to remediate in Phase 4.