How to Get a FinTech License in Cambodia

The National Bank of Cambodia classifies FinTech operators into distinct licensing categories based on the financial services they provide. The primary categories relevant to FinTech firms are Payment Service Providers (PSPs), E-Money Issuers, Microfinance Institutions (MFIs), and Banking Institutions. Each category carries different capital requirements, operational mandates, and reporting obligations. The NBC's regulatory philosophy emphasizes activity-based regulation: the license type is determined by what a firm does, not what it calls itself. A technology company that facilitates payments requires a PSP license. A platform that issues stored-value digital tokens needs an e-money license. A firm that extends credit digitally must obtain an MFI or banking license. This approach ensures regulatory coverage regardless of the business model's novelty.

The NBC license application follows a structured multi-phase process. Phase one involves pre-consultation, where the applicant meets with NBC's Financial Technology and Innovation Department to discuss the proposed business model and determine the appropriate license category. This informal phase typically takes 2-4 weeks and is strongly recommended before formal submission. Phase two is formal application, requiring submission of a comprehensive documentation package including business plan, financial projections, technology architecture documentation, AML/CFT policies, corporate governance structure, shareholder background checks, and proof of capital. Phase three is the NBC's due diligence review, during which the regulator evaluates the application, requests clarifications, and may conduct on-site inspections of technology infrastructure. Phase four is conditional approval, where the NBC issues approval subject to meeting specific pre-launch conditions. Phase five is license issuance upon satisfying all conditions.

Capital requirements represent one of the most significant barriers to entry in Cambodia's FinTech market. The NBC mandates minimum registered capital that must be fully paid-up and maintained in a Cambodian bank account before license issuance. For PSPs, the minimum is $500,000. E-money issuers must maintain $1.5 million. MFIs require $1.5 million (deposit-taking MFIs require $7.5 million). Specialized banks need $15 million. Beyond initial capital, the NBC imposes ongoing capital adequacy requirements. E-money issuers must maintain customer float in a segregated trust account at a licensed bank, with the total float covered by liquid assets at all times. PSPs must maintain a solvency ratio ensuring operational continuity for at least six months without revenue. These prudential requirements ensure that licensed FinTech firms can absorb operational losses and protect customer funds, but they also concentrate the market toward well-capitalized operators.

The NBC's regulatory sandbox, launched in 2023, offers an alternative pathway for FinTech firms with innovative business models that do not fit neatly into existing license categories. The sandbox allows firms to operate with real customers under relaxed regulatory requirements for a defined testing period, while the NBC observes the business model and develops appropriate regulations. Sandbox entry requires a separate application demonstrating genuine innovation, consumer benefit, and risk mitigation plans. Approved firms operate under a tailored regulatory framework with limitations on customer numbers (typically 2,000-5,000), transaction volumes, and geographic scope. The sandbox period lasts 6-12 months with possible extension. Upon successful completion, the firm either graduates to a full license under existing or newly created categories, or exits if the model proves unviable. Approximately 15 firms are currently operating in the sandbox across AI credit scoring, blockchain remittance, and embedded finance verticals.

Receiving the license is only the beginning. Licensed FinTech firms face extensive ongoing compliance obligations that require dedicated resources and systems. Monthly reporting to the NBC includes transaction volume data, customer complaint summaries, AML/CFT suspicious activity reports, and capital adequacy calculations. Quarterly reports cover financial statements, risk assessments, and technology incident logs. Annual obligations include audited financial statements by an NBC-approved auditor, a comprehensive AML/CFT risk assessment, technology security penetration testing by an independent firm, and business continuity plan updates. The NBC conducts on-site examinations at least annually, reviewing compliance with all regulatory conditions. Non-compliance can result in fines, operational restrictions, or license revocation. Building robust compliance infrastructure from day one is not optional -- it is a prerequisite for sustainable operation in Cambodia's regulated FinTech market.

Cambodia maintains one of ASEAN's most open foreign investment regimes for financial technology. The Council for the Development of Cambodia allows 100% foreign ownership of PSPs, e-money issuers, and banking institutions without requiring local joint venture partners. This has attracted FinTech firms from Singapore, Thailand, Japan, China, and South Korea to the Cambodian market. Practical requirements for foreign-owned FinTech firms include registering a Cambodia-domiciled legal entity with the Ministry of Commerce, maintaining a physical office presence in Phnom Penh, appointing at least one director resident in Cambodia, obtaining a tax identification number from the GDT, and registering for patent tax and VAT. Foreign exchange controls are minimal -- profits and capital can be repatriated freely under the Law on Foreign Exchange. The primary consideration for foreign entrants is ensuring that their corporate structure and capitalization meet NBC requirements before beginning the license application.

The most common reasons for license application delays or rejections include insufficient technology documentation, incomplete AML/CFT policy frameworks, unclear corporate governance structures, and inadequate capital planning. The NBC has become increasingly rigorous in evaluating technology architecture, requiring detailed documentation of system security, data protection measures, disaster recovery plans, and API integration specifications for Bakong and KHQR connectivity. Another frequent challenge is underestimating the compliance infrastructure needed before launch. The NBC expects licensed firms to have fully operational compliance management systems, trained compliance officers, automated transaction monitoring tools, and customer due diligence workflows before processing a single transaction. Firms that treat compliance as a post-launch activity face significant delays and conditional approval requirements that can extend timelines by 6-12 months beyond initial projections.