#
Tanzania's payment-services regime is anchored in the National Payment Systems Act No. 4 of 2015, with BoT as primary licensing/supervisory authority (jointly with TCRA for telecom-linked mobile money aspects). A 2025 Use of Foreign Currency regulation mandates TZS-only domestic pricing/payment; BoT issued draft Cybersecurity Guidelines for banks/PSPs/FSPs in March 2026; BoT opened the third cohort of its Fintech Regulatory Sandbox (applications closed 31 July 2026).
A further conditioning factor sits at the telecommunications layer: telco-based applicants additionally require a TCRA network or value-added service licence. This ties the payments licence to the communications regulator and shapes the realistic entry path for MNO-affiliated wallet operators, who must satisfy both regimes before launch. The core licensing framework has remained stable even as the Act was amended by the Finance Act 2021/2022 to introduce mobile-money levies; the licensing architecture itself was left unchanged.
Outlook
The module trajectory is established and stable. The licence-versus-approval split and the TCRA tie remain the defining entry determinants, and there is no evidenced change to the five-year licence term or the incorporation-in-Tanzania requirement. Active pipeline activity — illustrated by recent PSP authorisations — indicates a functioning authorisation channel rather than a closed market, but the bank/non-bank distinction will continue to govern how new entrants structure their market access.
Licensing, Authorisation & Market Access
Tanzania's payments-licensing perimeter tightened across multiple fronts this cycle, applying to both bank and non-bank participants. The Bank of Tanzania's 2025 Use of Foreign Currency regulation, reflected in the central bank's National Payment Systems Annual Report, requires that all domestic pricing and payment be conducted in Tanzanian shillings, with quoting or accepting foreign currency treated as an offence. This is a Tier-1, high-confidence finding sourced directly to the Bank of Tanzania's own annual report, and it applies without distinction between bank and non-bank payment-service providers, meaning any payments business settling or pricing transactions in foreign currency within Tanzania's domestic market must restructure around shilling-denominated pricing or risk violating the mandate.
Mobile money, Tanzania's dominant retail-payments rail, continues to sit under a dual-regulator licensing structure: the Bank of Tanzania issues payment-service authorisation while the Tanzania Communications Regulatory Authority separately enforces telecom compliance, and operating without either authorisation is treated as an offence. This dual-licensing structure is a Tier-4-sourced, Assessed-confidence finding, and it is a structural feature of the market rather than a new development this cycle, but its persistence alongside the new foreign-currency mandate compounds the compliance burden facing non-bank mobile-money operators specifically, since they must satisfy both financial and telecommunications regulators simultaneously while banks offering payment services face a comparatively simpler single-regulator path.
The Bank of Tanzania also issued draft Cybersecurity Guidelines for banks, payment service providers, and financial service providers in March 2026. Sourcing for this finding is a single Tier-4 legal-commentary account, with no Bank of Tanzania primary text resolved this cycle, capping confidence at Assessed. If finalised in their current form, the guidelines would bind entities under the Banking and Financial Institutions Act and the National Payment Systems Act, meaning the cybersecurity obligation would apply across the bank-PSP and non-bank-PI/EMI spectrum without an apparent tiering distinction in the sourcing currently available; this is a licensing-adjacent development insofar as compliance with forthcoming cybersecurity obligations is likely to become a condition of maintaining existing payment-service authorisation once the guidelines move from draft to binding form.
Separately, the Bank of Tanzania's Fintech Regulatory Sandbox opened its third cohort this cycle, with applications closing 31 July 2026 through the central bank's dedicated frsp.bot.go.tz portal. This is the primary formal pathway through which non-bank fintech innovators can trial novel payment products ahead of seeking full licensing, and a third cohort opening signals continued institutional bandwidth for supervised innovation even as the broader compliance perimeter, foreign-currency pricing, dual mobile-money licensing, and prospective cybersecurity obligations, hardens elsewhere in the framework. Read together, the sandbox and the tightening core-licensing requirements represent two ends of the same regulatory posture: Tanzania's regulator is simultaneously narrowing the compliance latitude available to established payment flows while preserving a supervised channel for new entrants to test products before those tightened requirements fully apply to them.
For market-access purposes, the practical takeaway this cycle is that neither bank nor non-bank status exempts a payments business from the core compliance requirements now in force or in draft: the foreign-currency mandate applies market-wide, the mobile-money dual-licensing requirement applies specifically to non-bank telecom-linked payment services, and the draft cybersecurity guidelines, once finalised, would apply across both categories. This is also a cold-start baseline cycle for Tanzania within this monitor's standing coverage, meaning there is no prior-period licensing baseline against which to measure the pace of this cycle's tightening; each of the findings above, the foreign-currency mandate, the mobile-money dual-licensing structure, the draft cybersecurity guidelines, and the sandbox cohort, is being established as a standing-coverage anchor for future-cycle comparison rather than assessed as a delta against a known prior state.
The content-tier distinction is worth noting for readers: the foreign-currency mandate and the mobile-money dual-licensing requirement are both standing-brief-tier findings warranting full explanatory treatment, reflecting their structural, ongoing character, while the sandbox cohort opening is more properly a dated dashboard-tier entry, a specific bounded event, the outcome of which will only become clear in a subsequent cycle. None of the findings in this module were corroborated by more than a single source this cycle, with the exception of the foreign-currency mandate, which carries Tier-1 sourcing directly to the Bank of Tanzania's own annual report; the mobile-money dual-licensing structure, the draft cybersecurity guidelines, and the sandbox cohort opening all rest on Tier-3 or Tier-4 secondary sourcing, and readers should weight the confidence of each accordingly.
Outlook
Watch for the draft cybersecurity guidelines to progress toward final, binding form, at which point the licensing-adjacent compliance obligation they impose across bank and non-bank payment-service providers alike would become concrete and enforceable. The outcome of the Fintech Regulatory Sandbox's third cohort, expected following the 31 July 2026 application deadline, is a second variable to track, since graduating participants would signal which novel payment products the Bank of Tanzania is prepared to license going forward. Enforcement activity, if any, under the 2025 Use of Foreign Currency regulation would also materially sharpen this module's risk read in subsequent cycles.
Sources and findings (5)
- T1https://www.bot.go.tz/PaymentSystem/regulations
- T1https://tanzanialaws.com/n/678-national-payment-systems-act
- T3https://www.lexology.com/library/detail.aspx?g=8f8b0d06-47f4-4ff4-a305-d3b0e807d4be
- T1https://www.bot.go.tz/Publications/NPS/GN-THE%20PAYMENT%20SYSTEMS%20LICENSING%20AND%20APPROVAL%20REGULATIONS%202015.pdf
- T3https://financialit.net/news/payments/bank-tanzania-grants-license-dpo-pay