Remote VASP serving residents in Rwanda
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Rwanda without local incorporation, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Conduct customer due diligence (CDD) including identifying and verifying name, address, date of birth, nationality, national ID number for individuals, and for legal entities: name, legal form, registration number, articles of incorporation, beneficial owners — per Law N° 060/2021 and Ministerial Orders N° 001/2022 and 002/2022.
- Apply a risk-based approach to CDD: enhanced due diligence (EDD) for PEPs, high-risk jurisdictions, and complex/unusually large transactions; simplified due diligence where lower risk applies.
- Conduct ongoing monitoring of business relationships and transactions to ensure consistency with the customer's risk profile.
- File Suspicious Transaction Reports (STRs) with the Financial Intelligence Centre (FIC) — no minimum monetary threshold; any transaction with reasonable grounds for suspicion must be reported promptly (typically within 2–5 business days).
- Screen all customers, beneficial owners, and counterparties against UN Security Council Consolidated List and other UN sanctions lists; immediately freeze assets of designated persons; report hits to the FIC without delay.
- Retain customer identification records, transaction records, business relationship records, and STR copies for at least 5 years after the end of the relationship or transaction date.
- Comply with No Tipping-Off prohibition — cannot disclose to customer or third party that an STR has been filed.
- Prudent operators should also screen against OFAC SDN List (due to USD transaction risk and U.S. nexus) and EU sanctions lists (due to EU jurisdictional nexus risks).
- Comply with any BNR directives on payment services if engaged in payment or transfer activity, per Law No. 008/2021 Governing Payment Systems.
Key Restrictions
- No formal VASP licensing regime exists yet — the regulatory framework for virtual assets is still developing, creating legal uncertainty for remote operators.
- BNR has consistently stated that virtual currencies are not legal tender and has issued public warnings discouraging their use, which creates reputational and regulatory risk for cross-border operators.
- Any payment or transfer-related crypto services may fall under Law No. 008/2021 Governing Payment Systems, potentially requiring BNR licensing or authorization.
- Without a local entity, enforcement and compliance oversight by the FIC and BNR is practically more challenging but does not eliminate legal obligations — AML/CFT duties under Rwandan law may still attach to services directed at residents.
Key Risks
- Enforcement risk is moderate but uncertain — BNR has focused on public warnings rather than enforcement actions against unlicensed operators, but this could change as the market matures.
- Lack of a formal licensing pathway means a remote VASP cannot achieve regulatory clarity; it operates in a grey area that could attract future penalties or be retroactively deemed unlawful.
- Limited market size reduces immediate enforcement priority, but the FIC is operational and expects STR filings for any suspicious activity involving Rwandan residents.
- Reputational risk from BNR public warnings — engaging with Rwandan residents despite central bank cautions could attract negative press or regulatory scrutiny.
- Secondary sanctions risk from U.S./EU sanctions regimes if the remote VASP processes USD transactions or uses U.S.-based analytics tools without adequate screening.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Rwanda's anti-money-laundering statute is Law nº 001/2025 of 22/01/2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction, Official Gazette nº Special Bis of 22/01/2025, which superseded Law nº 028/2023 of 19/05/2023, itself the successor to Law nº 75/2019. No Rwandan anti-money-laundering statute carries the number 060/2021. Reporting persons on the Financial Intelligence Centre's published list are 435 financial institutions and 3,128 designated non-financial businesses and professions, a class that excludes virtual asset service providers, whose anti-money-laundering duty arises instead as a licensing condition under Article 10(2)(g) of Law nº 023/2026 of 25/05/2026, supervised by the Capital Market Authority of Rwanda under Article 6.
Rwanda's general anti-money-laundering compliance requirements for reporting persons are set by Regulations nº 002/FIC/2026 of 22/06/2026, Official Gazette nº 25 Bis of 22/06/2026, issued by the Director General of the Financial Intelligence Centre, whose Article 45 repeals Regulations nº 002/FIC/2023 of 26/06/2023, and the matching sanctions instrument is Regulations nº 001/FIC/2026 of 22/06/2026 of the same date and gazette. Both are Financial Intelligence Centre regulations rather than ministerial orders, and neither mentions virtual assets or virtual asset service providers.
Ministerial Order N° 002/2022 of 28/01/2022 determining procedures for combating money laundering and financing of terrorism: This order details the procedural aspects of AML/CFT compliance.
The National Bank of Rwanda has published no virtual-asset circular or guideline; ESAAMLG's July 2024 mutual evaluation of Rwanda records that the central bank issued a public notice in 2023 warning against crypto-asset activity until a regulatory framework was in place, and since Law nº 023/2026 of 25/05/2026 regulating virtual asset business the licensing of virtual asset service providers belongs to the Capital Market Authority of Rwanda, with the National Bank of Rwanda confined by Article 8 to cooperation with that Authority and to directives on matters falling under its own purview.
Evidence fact rw.licensing.identification-and-verification-of-customers not found (may have been renamed).
For Individuals: Obtaining and verifying name, address, date of birth, nationality, national identification number (e.g., Rwandan ID card, passport number), and any other unique identifiers. This typically involves documentary verification (e.g., valid ID document) and, where appropriate, non-documentary methods.
For Legal Entities (Companies, Corporations, Trusts): Obtaining and verifying the entity's name, legal form, address, registration number, articles of incorporation, bylaws, and proof of existence. Identifying and verifying the identity of beneficial owners (individuals who ultimately own or control the entity, typically 25% ownership threshold or control through other means), as well as persons acting on behalf of the entity (e.g., directors, authorized signatories).
Ongoing Monitoring: Continuously monitoring the business relationship and transactions undertaken by customers to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes keeping customer information up-to-date.
Risk-Based Approach: Applying CDD measures based on a risk assessment. This means applying enhanced due diligence (EDD) for higher-risk customers (e.g., Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, complex or unusually large transactions) and simplified due diligence (SDD) for lower-risk customers (if permitted and justified). Due to the inherent risks of virtual assets, most VASP activities would generally require standard or enhanced CDD.
Reporting Threshold: There is no minimum monetary threshold for reporting suspicious transactions. Any transaction, regardless of amount, where there are reasonable grounds to suspect that it may be related to money laundering or terrorist financing, must be reported.
Timing: Reports must be made promptly, typically within a specified number of business days (e.g., 2-5 working days) of forming the suspicion.
No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an investigation is underway.
Customer Identification Records: All documents and information obtained during the CDD process (e.g., copies of identification documents, beneficial ownership information).
Transaction Records: Records of all transactions undertaken, sufficient to permit reconstruction of individual transactions (e.g., sender and receiver details, amounts, type of virtual asset, transaction hash/ID, date and time).
Business Relationship Records: Records pertaining to the business relationship, correspondence, and decisions made regarding the customer's risk profile.
Suspicious Transaction Reports (STRs): Copies of all STRs filed and any internal documentation supporting the decision to file (or not to file).
Duration: Records must generally be kept for a period of at least five (5) years after the end of the business relationship or the date of the transaction.
Financial Intelligence Centre (FIC) of Rwanda
The National Bank of Rwanda has published no virtual-asset circular or guideline; ESAAMLG's July 2024 mutual evaluation of Rwanda records that the central bank issued a public notice in 2023 warning against crypto-asset activity until a regulatory framework was in place, and since Law nº 023/2026 of 25/05/2026 regulating virtual asset business the licensing of virtual asset service providers belongs to the Capital Market Authority of Rwanda, with the National Bank of Rwanda confined by Article 8 to cooperation with that Authority and to directives on matters falling under its own purview.
Central Bank of Rwanda (BNR) - Official Website: The BNR is the primary financial regulator. Their official statements and publications are the most authoritative source.
Rwanda's operative anti-money-laundering statute is Law nº 001/2025 of 22/01/2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction, which replaced Law nº 028/2023 of 19/05/2023, itself the repeal of Law nº 75/2019 of 29/01/2020; no Rwandan anti-money-laundering law is numbered 008/2020, and the Financial Intelligence Centre is governed by Law nº 045/2021 of 18/08/2021 as amended by Law nº 002/2025 of 22/01/2025.
Law nº 008/2021 of 16/02/2021 governs partnerships, not payment systems; Rwanda's payment-system statute is Law nº 061/2021 of 14/10/2021, which makes no reference to virtual assets, and virtual asset business is licensed by the Capital Market Authority of Rwanda under Law nº 023/2026 of 25/05/2026, the National Bank of Rwanda being confined to monetary and financial-stability oversight and cooperation rather than licensing.
Requirements for VASPs: Once formally regulated, VASPs in Rwanda (or those dealing with Rwandan entities) must:
Screen all customers, beneficial owners, and counterparties against the UN Security Council Consolidated List and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).
Screen all customers, beneficial owners, and counterparties against the UN Security Council Consolidated List and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).
Requirements for VASPs: Due to the risk of secondary sanctions and disruption of international financial services, prudent VASPs operating in Rwanda should:
Rwanda enacted a comprehensive virtual-asset statute on 25 May 2026: Law nº 023/2026 of 25/05/2026 regulating virtual asset business, Official Gazette nº Special of 28/05/2026, which sets licensing conditions at Article 10, suspension and revocation at Article 11, a regulatory sandbox at Article 13, the virtual-asset service list at Article 14, administrative sanctions at Article 32 and offences at Articles 33 to 38, and makes the Capital Market Authority of Rwanda the licensing and supervisory authority. The implementing regulations remain unmade, so the licensing regime is in force yet not operable. No National Bank of Rwanda virtual-asset warning exists as a published central-bank instrument.
Rwanda's virtual-asset investor-protection rules are statutory and belong to the Capital Market Authority of Rwanda, at Articles 25 to 27 of Law nº 023/2026 of 25/05/2026 on investor protection, market conduct and data and asset protection, with technology and information security at Article 28 and inspections at Article 29. No National Bank of Rwanda cryptocurrency warning exists as a published central-bank instrument, and the Capital Market Authority's licensee register carries ten categories, from exchanges to investment advisers, with no virtual-asset category and no licensed virtual asset service provider.
Rwanda has a statutory virtual-asset licensing regime at Article 10 of Law nº 023/2026 of 25/05/2026, and enforcement runs through that statute rather than through general financial law: Article 6(b) directs the Capital Market Authority of Rwanda to identify a virtual asset service provider that contravenes the Law, Article 29 provides for inspections, Article 30 for freezing of virtual assets, Article 32 for administrative sanctions and Articles 33 to 38 for offences. Because the implementing regulations are unmade, no licence has been issued and no enforcement action has been published.
Limited Market Size: The cryptocurrency market in Rwanda may not yet be large enough to attract the scale of illicit activity or the number of unregulated operators that would trigger frequent, large-scale, and publicly reported enforcement actions seen in more mature or permissive crypto jurisdictions.
Virtual assets are not legal tender in Rwanda, and the rule is statutory rather than declaratory: Article 15 of Law nº 023/2026 of 25/05/2026 provides that virtual assets are not legal tender and cannot be used as a direct means of payment unless the National Bank of Rwanda authorises it. The National Bank of Rwanda has published no instrument of its own stating that position.
Rwanda's official position on virtual assets is set by statute rather than by warning. Article 15 of Law nº 023/2026 of 25/05/2026 bars natural persons from carrying on virtual asset business, provides that virtual assets are not legal tender and cannot be used as a direct means of payment unless the National Bank of Rwanda authorises it, requires approval for mining facilities, virtual-asset automated teller machines and mixer or tumbler services, and restricts marketing to licensed providers. Article 4(3) excludes algorithmic stablecoins, non-fungible tokens and central bank digital currency from the Law's scope.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a foreign-incorporated remote VASP may serve Rwandan residents, but must comply with Rwanda's AML/CFT obligations (CDD, STR filing to FIC, sanctions screening, record-keeping) under Law N° 060/2021 and related instruments, while operating in a grey area without a formal VASP licensing regime and facing BNR public warnings discouraging crypto use.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?