{"id":17493,"date":"2026-07-31T19:01:50","date_gmt":"2026-07-31T17:01:50","guid":{"rendered":"https:\/\/rahizi.org\/non-classe\/kibassa-maliba-digital-services-authorization-drc\/"},"modified":"2026-07-31T19:01:50","modified_gmt":"2026-07-31T17:01:50","slug":"kibassa-maliba-digital-services-authorization-drc","status":"publish","type":"post","link":"https:\/\/rahizi.org\/el\/loi-reglementation-afrique\/kibassa-maliba-digital-services-authorization-drc\/","title":{"rendered":"Digital operator in the DRC: understanding Minister Augustin Kibassa Maliba\u2019s order and getting compliant"},"content":{"rendered":"

Digital operator in the DRC: understanding Minister Augustin Kibassa Maliba\u2019s order and getting compliant<\/strong> is now urgent. Since 1 July 2026, twin ministerial orders of 11 March 2026 implement the Digital Code: one path requires prior authorization<\/strong>; the other a declaration<\/strong> with a certificate of approval. This guide helps you classify your activity, build the file, and start regularization with the ARPTC.<\/p>\n

General information based on published texts and legal commentary. It is not personalized legal advice. Final decisions rest with the competent authorities.<\/em><\/p>\n

What changed for digital services in the DRC?<\/h2>\n

On 11 March 2026, Digital Economy Minister Augustin Kibassa Maliba signed two ministerial orders (officially published around 17 March 2026) to implement Ordinance-Law No. 23\/010 of 13 March 2023 on the Digital Code:<\/p>\n

    \n
  • Order No. CAB\/MIN\/ECONUM\/AKIM\/MLNS\/ALM.004\/2026<\/strong> \u2014 conditions for reviewing applications and granting authorizations<\/strong> for digital activities and services;<\/li>\n
  • Order No. CAB\/MIN\/ECONUM\/AKIM\/MLNS\/ALM\/005\/2026<\/strong> \u2014 conditions for declaration<\/strong> and issuance of certificates of approval<\/strong>.<\/li>\n<\/ul>\n

    On a provisional basis, the ARPTC<\/strong> (Postal and Telecommunications Regulatory Authority of Congo) reviews files pending the full Digital Regulatory Authority. The rules apply to natural or legal persons, Congolese or foreign, when digital services are provided on DRC territory.<\/p>\n

    Do you need authorization or a declaration?<\/h2>\n

    Not every digital actor follows the same track. First, determine whether you fall under authorization (Order 004) or declaration (Order 005).<\/p>\n\n\n\n\n\n\n
    Regime<\/th>\nWho is typically covered<\/th>\nTitle issued<\/th>\nDuration<\/th>\n<\/tr>\n<\/thead>\n
    Authorization (004)<\/strong><\/td>\nData centers; qualified<\/em> trust service providers (e-signature, e-seal, timestamping, archiving, certification, website authentication, electronic registered mail, cryptology); application hosting; platforms and providers in a dominant position<\/strong> (cloud, marketplaces, app stores, social networks, content-sharing, online banking, fintech, matching platforms for travel\/transport\/hospitality\/e-commerce, search engines); essential digital services<\/td>\nMinisterial authorization<\/td>\n5 years, renewable<\/td>\n<\/tr>\n
    Declaration (005)<\/strong><\/td>\nCongolese startups, non-dominant<\/strong> platforms, non-qualified<\/em> trust services, and other activities under the declarative regime<\/td>\nCertificate of approval<\/td>\n3 years, renewable<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Watch-out: an ex-post check can reclassify<\/strong> a declared activity as one requiring authorization, with a formal notice and possible suspension. A legal diagnosis before filing reduces that risk.<\/p>\n

    Timeline: what to do after 30 June 2026<\/h2>\n

    A transitional period ran until 30 June 2026<\/strong>. From 1 July 2026<\/strong>, the rules apply in full. Operating without the required title exposes you to administrative sanctions (fine, shortened validity, suspension, withdrawal) and possible criminal penalties under applicable law.<\/p>\n

    If you have not filed yet: prioritize regime diagnosis, file completeness, and ARPTC submission\u2014do not wait for an administrative reminder.<\/p>\n

    How to obtain authorization (Order 004)<\/h2>\n

    The authorization path runs through the ARPTC, then the minister:<\/p>\n

      \n
    1. Draft the application in French<\/strong> and file two copies<\/strong> with the regulator, against a receipt (date and registration number).<\/li>\n
    2. Attach proof of payment of the file review fees<\/strong>\u2014without it, the file is inadmissible.<\/li>\n
    3. The ARPTC reviews a complete file within a maximum of 30 days<\/strong> (additional documents may be requested).<\/li>\n
    4. A reasoned opinion goes to the minister, who has 15 working days<\/strong> to decide.<\/li>\n
    5. If approved: authorization by ministerial order, notification, and payment of duties to the Public Treasury.<\/li>\n
    6. If refused with reasons: one revision request may be refiled free of charge<\/strong> after corrections; after two refusals, a new paid application is required.<\/li>\n<\/ol>\n

      Important:<\/strong> the filing receipt is neither a provisional authorization nor a right to operate. Authorization comes with a specifications \/ licence conditions document<\/strong> (technical, financial and organizational duties, security and data protection). Merger, change of majority shareholding or corporate name trigger a revision. Assignment or transfer requires the minister\u2019s prior consent.<\/p>\n

      For fintech<\/strong> \/ payment aggregators, digital authorization may sit alongside Central Bank of Congo approval: plan both tracks.<\/p>\n

      What must the authorization file contain?<\/h2>\n

      A typical Order 004 file includes:<\/p>\n

        \n
      • signed authorization request letter;<\/li>\n
      • applicant identification form;<\/li>\n
      • detailed description of digital activities and services + general terms;<\/li>\n
      • three-year<\/strong> business plan;<\/li>\n
      • notarized articles of association (legal entities);<\/li>\n
      • RCCM or equivalent for foreign-law entities;<\/li>\n
      • tax identification number and valid tax clearance;<\/li>\n
      • non-bankruptcy certificate less than three months old (except recent registrations);<\/li>\n
      • proof of payment of review fees;<\/li>\n
      • proof of technical reliability (especially for qualified trust service providers).<\/li>\n<\/ul>\n

        Declaration regime (Order 005): the essentials<\/h2>\n

        The declarative path is lighter: declaration filing, review fees, processing, and a certificate of approval<\/strong> (three years, renewable six months before expiry). Published information points to roughly a fifteen-day review for a complete file. Ex-post checks cover declared compliance, cybersecurity and data protection. Sanctions may include a fine, suspension or withdrawal of the certificate.<\/p>\n

        What are the sanctions for non-compliance?<\/h2>\n

        For authorization holders, after the regulator\u2019s opinion and an unsuccessful 15-day formal notice, the minister may impose a fine, shorten the title\u2019s validity, suspend it or withdraw it. Operating without a valid title also triggers sanctions under applicable legislation. Renewal of authorization or certificate should normally be requested six months before<\/strong> expiry.<\/p>\n

        Common mistakes to avoid<\/h2>\n
          \n
        • Confusing a certificate of approval<\/strong> with a ministerial authorization<\/strong>.<\/li>\n
        • Treating the filing receipt as a right to operate.<\/li>\n
        • Underestimating the dominant position<\/strong> test for a platform.<\/li>\n
        • Filing incomplete tax papers or a missing non-bankruptcy certificate.<\/li>\n
        • Ignoring the Central Bank track for certain fintech activities.<\/li>\n
        • Choosing declaration without assessing reclassification risk.<\/li>\n<\/ul>\n

          How RAHIZI supports every step of the file<\/h2>\n

          RAHIZI has for years supported founders and companies structuring their presence in Central Africa\u2014especially in the Democratic Republic of the Congo\u2014through StartRDC and a network of local lawyers and professionals. We know how desks work, which documents must be current, and how timelines behave for founders based abroad.<\/p>\n

          On the post\u2013Kibassa Maliba digital compliance track, we work step by step:<\/p>\n

            \n
          1. Diagnosis<\/strong> \u2014 authorization (004) vs declaration (005), reclassification risk map.<\/li>\n
          2. File assembly<\/strong> \u2014 legal, tax, technical and business-plan documents, completeness check before filing.<\/li>\n
          3. Legal coordination<\/strong> \u2014 joint work with a specialist attorney in Congolese digital law.<\/li>\n
          4. Filing and follow-up<\/strong> \u2014 ARPTC deposit, responses to document requests, tracking of the opinion and decision.<\/li>\n
          5. After the title<\/strong> \u2014 licence conditions, renewal, revision on merger or shareholding change.<\/li>\n<\/ol>\n

            We do not promise approval: authorities decide. Our role is to make the file solid, consistent and followed through.<\/p>\n

            FAQ \u2014 Kibassa Maliba orders and DRC digital compliance<\/h2>\n

            Is a Congolese startup always under declaration?<\/h3>\n

            Often yes if it is not dominant and does not fall into authorization categories. Dominance and the exact nature of the service can move the file to authorization. Case-by-case diagnosis remains necessary.<\/p>\n

            Is a foreign cloud or marketplace targeting DRC users covered?<\/h3>\n

            Yes, when digital services are provided on Congolese territory, regardless of nationality or seat. Large platforms and dominant providers typically fall under authorization.<\/p>\n

            Does the filing receipt let me operate while waiting?<\/h3>\n

            No. The acknowledgment is neither a provisional authorization nor a right to operate. Wait for the formal title (authorization or certificate of approval).<\/p>\n

            What if I did not regularize before 1 July 2026?<\/h3>\n

            Start diagnosis and filing immediately. A complete, coherent file reduces the risk of refusal, formal notice or sanctions for operating without a title.<\/p>\n

            Does a fintech need two authorizations?<\/h3>\n

            For certain payment aggregators and regulated activities, Central Bank of Congo approval may sit alongside the digital economy minister\u2019s authorization. Build both into the timeline.<\/p>\n

            How long does the review take?<\/h3>\n

            For authorization: up to 30 days ARPTC review, then up to 15 working days for the ministerial decision, excluding delays from missing documents. For declaration, published timelines are shorter (around fifteen days for a complete file).<\/p>\n

            Book a meeting with a DRC digital law specialist attorney<\/h2>\n

            Need to know whether your activity requires authorization or declaration, and how to build an admissible file? Fill in the form: we will arrange a meeting with a specialist attorney in Congolese digital law to frame your regularization plan.<\/p>\n

            <\/div>
            <\/div>