Custodial wallet / SaaS in Rwanda

Rwanda's anti-money-laundering statute is Law nº 001/2025 of 22/01/2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction, Official Gazette nº Special Bis of 22/01/2025, which superseded Law nº 028/2023 of 19/05/2023, itself the successor to Law nº 75/2019. No Rwandan anti-money-laundering statute carries the number 060/2021. Reporting persons on the Financial Intelligence Centre's published list are 435 financial institutions and 3,128 designated non-financial businesses and professions, a class that excludes virtual asset service providers, whose anti-money-laundering duty arises instead as a licensing condition under Article 10(2)(g) of Law nº 023/2026 of 25/05/2026, supervised by the Capital Market Authority of Rwanda under Article 6.

Rwanda's general anti-money-laundering compliance requirements for reporting persons are set by Regulations nº 002/FIC/2026 of 22/06/2026, Official Gazette nº 25 Bis of 22/06/2026, issued by the Director General of the Financial Intelligence Centre, whose Article 45 repeals Regulations nº 002/FIC/2023 of 26/06/2023, and the matching sanctions instrument is Regulations nº 001/FIC/2026 of 22/06/2026 of the same date and gazette. Both are Financial Intelligence Centre regulations rather than ministerial orders, and neither mentions virtual assets or virtual asset service providers.

Ministerial Order N° 002/2022 of 28/01/2022 determining procedures for combating money laundering and financing of terrorism: This order details the procedural aspects of AML/CFT compliance.

The National Bank of Rwanda has published no virtual-asset circular or guideline; ESAAMLG's July 2024 mutual evaluation of Rwanda records that the central bank issued a public notice in 2023 warning against crypto-asset activity until a regulatory framework was in place, and since Law nº 023/2026 of 25/05/2026 regulating virtual asset business the licensing of virtual asset service providers belongs to the Capital Market Authority of Rwanda, with the National Bank of Rwanda confined by Article 8 to cooperation with that Authority and to directives on matters falling under its own purview.

Evidence fact rw.licensing.identification-and-verification-of-customers not found (may have been renamed).

For Individuals: Obtaining and verifying name, address, date of birth, nationality, national identification number (e.g., Rwandan ID card, passport number), and any other unique identifiers. This typically involves documentary verification (e.g., valid ID document) and, where appropriate, non-documentary methods.

For Legal Entities (Companies, Corporations, Trusts): Obtaining and verifying the entity's name, legal form, address, registration number, articles of incorporation, bylaws, and proof of existence. Identifying and verifying the identity of beneficial owners (individuals who ultimately own or control the entity, typically 25% ownership threshold or control through other means), as well as persons acting on behalf of the entity (e.g., directors, authorized signatories).

Understanding the Purpose and Intended Nature of the Business Relationship: VASPs must understand why the customer wants to use their services and the anticipated level and type of activity.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions undertaken by customers to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes keeping customer information up-to-date.

Risk-Based Approach: Applying CDD measures based on a risk assessment. This means applying enhanced due diligence (EDD) for higher-risk customers (e.g., Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, complex or unusually large transactions) and simplified due diligence (SDD) for lower-risk customers (if permitted and justified). Due to the inherent risks of virtual assets, most VASP activities would generally require standard or enhanced CDD.

Reporting Threshold: There is no minimum monetary threshold for reporting suspicious transactions. Any transaction, regardless of amount, where there are reasonable grounds to suspect that it may be related to money laundering or terrorist financing, must be reported.

Content of Report: STRs must contain comprehensive details about the customer, the transaction(s), and the reasons for the suspicion.

Timing: Reports must be made promptly, typically within a specified number of business days (e.g., 2-5 working days) of forming the suspicion.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an investigation is underway.

Customer Identification Records: All documents and information obtained during the CDD process (e.g., copies of identification documents, beneficial ownership information).

Transaction Records: Records of all transactions undertaken, sufficient to permit reconstruction of individual transactions (e.g., sender and receiver details, amounts, type of virtual asset, transaction hash/ID, date and time).

Business Relationship Records: Records pertaining to the business relationship, correspondence, and decisions made regarding the customer's risk profile.

Suspicious Transaction Reports (STRs): Copies of all STRs filed and any internal documentation supporting the decision to file (or not to file).

Duration: Records must generally be kept for a period of at least five (5) years after the end of the business relationship or the date of the transaction.

Financial Intelligence Centre (FIC) of Rwanda

The National Bank of Rwanda has published no virtual-asset circular or guideline; ESAAMLG's July 2024 mutual evaluation of Rwanda records that the central bank issued a public notice in 2023 warning against crypto-asset activity until a regulatory framework was in place, and since Law nº 023/2026 of 25/05/2026 regulating virtual asset business the licensing of virtual asset service providers belongs to the Capital Market Authority of Rwanda, with the National Bank of Rwanda confined by Article 8 to cooperation with that Authority and to directives on matters falling under its own purview.

Central Bank of Rwanda (BNR) - Official Website: The BNR is the primary financial regulator. Their official statements and publications are the most authoritative source.

Rwanda's operative anti-money-laundering statute is Law nº 001/2025 of 22/01/2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction, which replaced Law nº 028/2023 of 19/05/2023, itself the repeal of Law nº 75/2019 of 29/01/2020; no Rwandan anti-money-laundering law is numbered 008/2020, and the Financial Intelligence Centre is governed by Law nº 045/2021 of 18/08/2021 as amended by Law nº 002/2025 of 22/01/2025.

Law nº 008/2021 of 16/02/2021 governs partnerships, not payment systems; Rwanda's payment-system statute is Law nº 061/2021 of 14/10/2021, which makes no reference to virtual assets, and virtual asset business is licensed by the Capital Market Authority of Rwanda under Law nº 023/2026 of 25/05/2026, the National Bank of Rwanda being confined to monetary and financial-stability oversight and cooperation rather than licensing.

Requirements for VASPs: Once formally regulated, VASPs in Rwanda (or those dealing with Rwandan entities) must:

Screen all customers, beneficial owners, and counterparties against the UN Security Council Consolidated List and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).

Immediately freeze funds and other assets of designated individuals and entities.

Articles 6 and 7 of Rwanda's Regulations on Targeted Financial Sanctions of 26/08/2021 require a reporting person to report to the Financial Intelligence Centre without delay whether funds or other assets of a designated person were identified and to notify attempted dealings with frozen assets, but virtual asset service providers are not among Rwanda's reporting persons, their obligations arising instead under Law nº 023/2026.

Refrain from making funds or economic resources available, directly or indirectly, to sanctioned parties.

Dealing with U.S. persons (citizens, residents, entities, branches globally).

Screen all customers, beneficial owners, and counterparties against the UN Security Council Consolidated List and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).

Block transactions and freeze assets of designated individuals and entities.

Refrain from engaging in any activity that could be considered a violation or circumvention of OFAC sanctions.

Rwanda enacted a comprehensive virtual-asset statute on 25 May 2026: Law nº 023/2026 of 25/05/2026 regulating virtual asset business, Official Gazette nº Special of 28/05/2026, which sets licensing conditions at Article 10, suspension and revocation at Article 11, a regulatory sandbox at Article 13, the virtual-asset service list at Article 14, administrative sanctions at Article 32 and offences at Articles 33 to 38, and makes the Capital Market Authority of Rwanda the licensing and supervisory authority. The implementing regulations remain unmade, so the licensing regime is in force yet not operable. No National Bank of Rwanda virtual-asset warning exists as a published central-bank instrument.

Rwanda's virtual-asset investor-protection rules are statutory and belong to the Capital Market Authority of Rwanda, at Articles 25 to 27 of Law nº 023/2026 of 25/05/2026 on investor protection, market conduct and data and asset protection, with technology and information security at Article 28 and inspections at Article 29. No National Bank of Rwanda cryptocurrency warning exists as a published central-bank instrument, and the Capital Market Authority's licensee register carries ten categories, from exchanges to investment advisers, with no virtual-asset category and no licensed virtual asset service provider.

Rwanda has a statutory virtual-asset licensing regime at Article 10 of Law nº 023/2026 of 25/05/2026, and enforcement runs through that statute rather than through general financial law: Article 6(b) directs the Capital Market Authority of Rwanda to identify a virtual asset service provider that contravenes the Law, Article 29 provides for inspections, Article 30 for freezing of virtual assets, Article 32 for administrative sanctions and Articles 33 to 38 for offences. Because the implementing regulations are unmade, no licence has been issued and no enforcement action has been published.

Limited Market Size: The cryptocurrency market in Rwanda may not yet be large enough to attract the scale of illicit activity or the number of unregulated operators that would trigger frequent, large-scale, and publicly reported enforcement actions seen in more mature or permissive crypto jurisdictions.

Virtual assets are not legal tender in Rwanda, and the rule is statutory rather than declaratory: Article 15 of Law nº 023/2026 of 25/05/2026 provides that virtual assets are not legal tender and cannot be used as a direct means of payment unless the National Bank of Rwanda authorises it. The National Bank of Rwanda has published no instrument of its own stating that position.

Rwanda's official position on virtual assets is set by statute rather than by warning. Article 15 of Law nº 023/2026 of 25/05/2026 bars natural persons from carrying on virtual asset business, provides that virtual assets are not legal tender and cannot be used as a direct means of payment unless the National Bank of Rwanda authorises it, requires approval for mining facilities, virtual-asset automated teller machines and mixer or tumbler services, and restricts marketing to licensed providers. Article 4(3) excludes algorithmic stablecoins, non-fungible tokens and central bank digital currency from the Law's scope.