Congo is going online fast, and its rules for keeping that safe are catching up. Seven draft decrees, unveiled in Kinshasa this week, would spell out what digital firms and government bodies must do to protect their systems.
The decrees were shown on Tuesday, 3 November, at a workshop run by the Ministry of Digital Economy and the telecoms regulator, ARPTC. They would add detail to the 2023 Digital Code. They set basic security standards, name key digital systems, require audits and make firms report attacks. They are still drafts. The workshop is meant to gather comments before they are adopted.
The drafts cover several areas. These include basic security needs, how to spot critical digital systems, audits and reports of attacks. They also say who is responsible for what, and what duties digital service providers carry. Other parts cover how the rules are run. They also cover lists of AI tools in use, and work with other countries.
They build on a law already in place. The Digital Code, signed in March 2023, requires digital service providers to spot events that could harm their systems. It also calls for checks on how well they are protected. Articles 295 and 296 carry those duties. A new body, the National Cybersecurity Agency (ANCY), will help enforce them. Its structure was set by an ordinance of 16 May 2026, and its missions include control, auditing and coordinating national cybersecurity policy.
| Date | Step |
|---|---|
| 2022. | Cyber strategy with seven axes. |
| March 2023. | Digital Code adopted. |
| 11 Feb 2026. | Licence rules for digital services. |
| 16 May 2026. | ANCY set up by ordinance. |
| 1 July 2026. | Licence rules take full effect. |
| 23 Oct 2026. | Cabinet orders audit of state IT. |
| 3 Nov 2026. | Seven draft decrees presented. |
The February order matters for any business. Data centres, cloud services, e-signature services and big digital platforms must hold a licence. That includes social networks, app stores, online shops, banks and fintechs. Firms had until 30 June 2026 to apply. From 1 July, work without a licence is illegal. The new decrees add the security layer on top of that licence.
The push has been building. On 23 October, President Félix Tshisekedi’s cabinet ordered an audit of the state’s digital systems. It also asked for constant monitoring, early alerts and training for public staff. Officials also told agencies to fix two serious flaws in PHP, a common web tool. A year earlier, in October 2025, the government denied social media claims that the Presidency and the Central Bank had been hit by cyberattacks. It called them disinformation.
Why now? Because the country is connecting quickly. Mobile subscriptions reached nearly 74 million by the end of 2025, about 66% of the population. That is 2.5 times the 29.3 million of 2017. Mobile money has grown with it, and so has fraud. SIM swapping, where criminals take over a victim’s phone number to reach their accounts, is a growing worry. In one case, GiveDirectly lost about $1.2 million when fraudsters used the method. Staff were allegedly involved. The regulator now asks for fingerprints or face scans when people get a new SIM. But some shops lack the kit, and many users know too little about the risks.
How does Congo rank? The UN’s telecoms agency, the ITU, put Congo in the third of five tiers in its 2024 cyber index. The tier is called “Establishing.” That tier is for countries that have taken steps but must still build capacity. Some simple counting puts it in context. 75 countries rank in the top two tiers, 49 are in Congo’s tier and 70 sit in the bottom two. That makes DRC a middle-of-the-pack country. These counts are ours, from the ITU’s published tier sizes.
The hard part will be enforcement. Legal analysts note that regulators in the region often lack money and tools. Rules on paper protect no one until they are applied. The World Bank and the French development agency AFD have backed a $500 million digital package that includes a government cybersecurity centre. That money will help. People and skills will matter just as much.
Why it matters: For startups, banks and telecoms working in Congo, security is about to become a legal duty, not a nice extra. Fintechs, cloud providers and marketplaces that already need an authorisation could soon need audits, incident reports and proof of controls too. That raises costs for small firms. But it also protects honest operators from fraud that harms trust in the whole sector. Investors will look for clean compliance in a market of about 100 million people. Founders who build security in early will be ready when the rules land.
What to watch next: when the decrees are finalised, and whether the final texts set clear deadlines, fines and thresholds for smaller firms. Also watch how ANCY is staffed and funded, and whether the national audit of state systems is published. Another test is how the AI registers work in practice.
Sources: Samira Njoya, “In the DRC, the regulatory framework for cybersecurity is entering a new phase,” 4 November 2026; Digital Business Africa on the 23 October Council of Ministers and audit of state systems; Osiris on the planned continuous monitoring of state IT systems; Droit Médias Finance on the February 2026 authorisation order; Digital Business Africa on the government’s October 2025 denial; African Business on cybersecurity as DRC comes online; ENACT on SIM swapping in the DRC; ITU Global Cybersecurity Index 2024.
A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.
