Rwanda Gazettes First Law Regulating Virtual Asset Business

On 28 May 2026, the Government of Rwanda gazetted the Law nº 023/2026 of 25/05/2026 regulating virtual asset business (the "Law"). The Law, which is the first of its kind in Rwanda establishes a comprehensive legal framework for the development and regulation of virtual asset business in the country.

The Law is principally aimed at preventing and mitigating the risks of money laundering, terrorist financing and proliferation financing posed by virtual assets, while also maintaining market integrity and financial stability, protecting consumers and investors, and fostering innovation in the sector. It applies to virtual asset service providers and issuers operating in Rwanda but expressly excludes the supply of logistics and technical assistance services, the manufacture of hardware and engineering of software services, and services to hardware wallet manufacturers.

Central to the Law is the concept of a "virtual asset", defined as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes. Notably, the definition carves out digital representations of fiat currencies, payment instruments regulated by the Central Bank, securities and capital market instruments, central bank digital currencies, non-fungible tokens, anonymity-enhanced virtual assets, algorithm-based stablecoins, and assets operating within closed-loop systems. The Law clarifies that virtual assets are not recognised as legal tender in Rwanda, and they may not be used directly as a means of payment for goods, services or other financial obligations unless authorised by the Central Bank.

The Law designates the Capital Market Authority of Rwanda (the "Regulatory Authority") as the body responsible for regulating all matters relating to virtual asset business. The Regulatory Authority's functions include approving and supervising the issuance of virtual assets and the tokenisation of real-world assets, ensuring investor and consumer protection and promoting innovation. Its powers extend to issuing, suspending, revoking or altering licences, issuing regulations, directives and guidelines, and suspending or banning specific types of virtual assets where considered necessary. The Law further establishes a framework for cooperation between the Regulatory Authority and the Central Bank to ensure harmonisation of policies and the oversight of monetary and financial stability implications of virtual asset business.

Under the licensing part, a legal entity intending to provide virtual asset services must apply to the Regulatory Authority for a licence in the manner prescribed by the regulations (not yet issued by the Regulatory Authority). A licence will be granted where the Regulatory Authority is satisfied that the applicant is a legal entity incorporated in Rwanda (or, if incorporated abroad, is duly registered and maintains a local presence in Rwanda), has a proper and transparent ownership structure with full disclosure of beneficial owners, has sound governance arrangements including an effective board and fit and proper senior management, has adequate financial, technical and operational capacity, maintains minimum paid-up and liquid capital as prescribed by regulations (not yet issued by the Regulatory Authority), and has effective AML/CFT/CPF controls aligned with applicable laws and international standards. It should be noted that natural persons are expressly prohibited from conducting or purporting to conduct virtual asset business in Rwanda.

The Law imposes extensive ongoing obligations on virtual asset service providers. These include periodic reporting to the Regulatory Authority on accounts opened, transaction values, fraud incidents and customer complaints, the reporting of all suspicious transactions regardless of amount, and the filing of audited financial statements. Virtual asset service providers must also immediately notify the Regulatory Authority in writing of specified events such as impending insolvency, cyber-attacks, involvement in criminal proceedings, or any event that may threaten financial stability. Further, the Law requires compliance with originator and beneficiary information requirements for virtual asset transfers (commonly referred to as the "travel rule"), the maintenance of minimum liquidity ratios and sufficient liquid assets, the provision of accurate information and cost disclosures to consumers and investors, and the implementation of robust cybersecurity measures, business continuity systems, data protection safeguards and transaction tracing tools, all subject to periodic audit by independent qualified auditors.

The penalties for non-compliance are significant. A natural person who engages in virtual asset business faces a fine of FRW 30,000,000 to FRW 50,000,000 and/or imprisonment of three to five years. A legal entity that provides virtual asset services without a licence is liable to a fine of FRW 70,000,000 to FRW 100,000,000, while issuing virtual assets without approval attracts a fine of FRW 120,000,000 to FRW 150,000,000. Marketing virtual assets business without a licence or approval carries a fine of FRW 15,000,000 to FRW 20,000,000, and the provision of false or misleading information to, or obstruction of, the Regulatory Authority is punishable by a fine of FRW 3,000,000 to FRW 5,000,000 and/or imprisonment of six months to one year. Unauthorised use of virtual assets for payment, the operation of mining facilities, crypto ATMs or mixer/tumbler services without authorisation is punishable, for natural persons, by a fine of FRW 20,000,000 to FRW 30,000,000 and/or imprisonment of two to three years, and for legal entities by a fine of FRW 70,000,000 to FRW 100,000,000. Administrative faults and sanctions are to be further detailed by regulations.

The Law also introduces a regulatory sandbox framework, providing a controlled environment in which innovative business models related to virtual assets that fall outside the scope of the Law may be tested on a limited basis, with the possibility of applying for a full licence or approval upon successful completion.

With this Law now in place, international and local businesses contemplating entry into, Rwanda's virtual asset sector should take immediate steps to assess the requirements of the Law and how it impacts their businesses.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.