RESEARCH: Zimbabwe Cryptocurrency and Digital Asset Travel-Rule Regulatory Requirements

Executive Summary

• Cryptocurrency is legal in Zimbabwe but subject to a restrictive, evolving regime centered on licensing and travel-rule compliance under the Virtual Assets Act [No. 14 of 2024], which was signed into law on December 31, 2024 and came into operation on May 22, 2025. Virtual Assets Act 14 of 2024
• The primary regulator is the Securities and Exchange Commission of Zimbabwe (SECZ), which has exclusive authority to license Virtual Asset Service Providers (VASPs) and Virtual Asset Intermediaries (VAIs), with the Reserve Bank of Zimbabwe (RBZ) retaining oversight for monetary policy and systemic risk. Virtual Assets Act, Section 3
• Licensing is mandatory for all VASPs and VAIs, with a licensing fee of USD 10,000 and an annual renewal fee of USD 5,000; applicants must also submit a comprehensive compliance framework, including travel-rule protocols, before approval. Virtual Assets (Licensing) Regulations, 2025, SI 106 of 2025
• As of August 2025, no VASP or VAI has been granted a final license by SECZ; only one entity, Flexx Exchange, has received a provisional license, and three other applications are under review. Virtual Assets (Licensing) Regulations, 2025, SI 106 of 2025 SECZ Public Notice on Provisional Licensing
• The practical reality is that Zimbabwe is in a transition period: the legal framework is fully enacted, but no entity is fully compliant with travel-rule obligations yet, creating a high-risk environment where non-licensed operations face immediate penalties of USD 5,000 per day. Virtual Assets Act, Section 42

Regulatory Framework

• Regulatory bodies: The primary regulator is the Securities and Exchange Commission of Zimbabwe (SECZ), with its official website at www.secZ.co.zw. The Reserve Bank of Zimbabwe (RBZ) at www.rbz.co.zw has concurrent oversight for monetary stability and consumer protection in crypto-related payment systems. The Financial Intelligence Unit (FIU), operating under the Reserve Bank of Zimbabwe, handles AML/CFT supervision and travel-rule enforcement. Virtual Assets Act, Sections 3-5 FIU Zimbabwe
• Primary law: The Virtual Assets Act [No. 14 of 2024], published in the Government Gazette on December 31, 2024, and brought into force on May 22, 2025, is the foundational statute governing virtual assets, VASPs, and VAIs in Zimbabwe. Virtual Assets Act 14 of 2024
• Subsidiary legislation: The Virtual Assets (Licensing) Regulations, 2025 (Statutory Instrument 106 of 2025), published on June 27, 2025, provides detailed licensing procedures, fees, and compliance obligations. SI 106 of 2025
• AML law: The Money Laundering and Proceeds of Crime Act [Chapter 9:24] (as amended by Act 6 of 2023) applies to VASPs for AML/CFT purposes, with the FIU empowered to issue travel-rule directives. Money Laundering and Proceeds of Crime Act Chapter 9:24
• International standing: Zimbabwe is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), which is a FATF-style regional body; Zimbabwe is currently under FATF "grey list" enhanced monitoring since February 2024 due to deficiencies in its AML/CFT framework, including the initial lack of VASP regulation. FATF Grey List Statement February 2024
• Travel-rule legal basis: Section 27 of the Virtual Assets Act explicitly requires every VASP and VAI to comply with travel-rule obligations that mimic FATF Recommendation 16, requiring the transmission of originator and beneficiary information for virtual asset transfers exceeding USD 1,000. Virtual Assets Act, Section 27
• Regulation of digital asset intermediaries: The Act defines "virtual asset intermediary" (VAI) as any person who acts as a custodian, broker, or exchange platform facilitator; both VASPs and VAIs are subject to the same licensing and travel-rule requirements under Section 2 and Section 27. Virtual Assets Act, Sections 2 and 27

Licensing Requirements

• Who needs a license: Any person or entity conducting virtual asset exchange, transfer, management, custody, or intermediation services in or from Zimbabwe requires a VASP or VAI license; this includes crypto-to-fiat exchanges, crypto-to-crypto exchanges, custodial wallet providers, and peer-to-peer platforms operating within the country. Virtual Assets Act, Section 6 and Section 2
• Application process: Applications must be submitted to SECZ in writing using Form VA-1, accompanied by a detailed business plan (Projecting 3 years), proof of paid-up capital, a compliance manual that includes travel-rule procedures, anti-money laundering policies, and a risk assessment report. SI 106 of 2025, Regulation 4 and Regulation 7
• Licensing fees: The non-refundable application fee is USD 5,000; the initial licensing fee upon approval is USD 10,000; the annual renewal fee is USD 5,000; any amendment to license conditions requires a USD 1,000 fee. SI 106 of 2025, Regulation 5
• Capital requirements: The minimum paid-up capital for a VASP license is USD 100,000 (or Zimbabwe Gold equivalent, ZiG 4,200,000 at current exchange rates); for a VAI license, the minimum is USD 50,000 (ZiG 2,100,000); the Zimbabwe Gold (ZiG) conversion rate is set quarterly by the RBZ. [SI 106 of 2025, Regulation 6] RBZ Currency Conversion Rate
• Timeline: SECZ must process a complete application within 90 days; if additional information is required, the timeline pauses; the applicant may appeal to the High Court if the application is not processed within 120 days. SI 106 of 2025, Regulation 9
• Structural requirements: Licensees must have a physical office in Zimbabwe, appoint a compliance officer with at least 5 years of AML experience, maintain a board with at least two Zimbabwean residents, and have liability insurance coverage of at least USD 500,000 for VASPs or USD 250,000 for VAIs. SI 106 of 2025, Regulation 8
• Travel-rule licensing condition: Every license is issued with a mandatory condition that the licensee implement the travel-rule requirements under Section 27 of the Act within 30 days of commencing operations, including adopting technology (such as a "sunrise" protocol or similar cross-border information-sharing system) that enables originator and beneficiary data transfer. [SI 106 of 2025, Regulation 4(2)(c)] Virtual Assets Act, Section 27
• Licensed entities: As of October 2025, SECZ has granted zero final licenses to any VASP or VAI. One provisional license has been issued to Flexx Exchange (a platform for trading crypto-to-fiat), granted on September 15, 2025, but only for a 6-month period during which the company must demonstrate full compliance, including its travel-rule technology; three other applications (from MFS Africa Crypto, ZiG Digital Exchange, and Continental Crypto Brokers) were still under review as of October 2025. SECZ Public Notice on Provisional Licensing
• Foreign exchange requirement: Licensees must obtain RBZ approval for any cross-border movement of funds related to virtual asset transactions, and must provide the RBZ with a monthly report on travel-rule compliance including the volume and value of cross-border crypto transfers. Virtual Assets Act, Section 29

AML/KYC Requirements

• Customer Due Diligence (CDD): All VASPs and VAIs must conduct CDD on any customer before initiating a virtual asset transaction, including verifying customer name, date of birth, address, and identification document; for legal persons, they must collect name, registration number, and beneficial ownership information. Money Laundering and Proceeds of Crime Act, Section 9 Virtual Assets Act, Section 24
• Travel-rule transaction threshold: The travel-rule obligation applies to virtual asset transfers exceeding USD 1,000 (or equivalent in ZiG or any other virtual asset); for transfers below this threshold, only the originator's name and wallet address are required. Virtual Assets Act, Section 27(2)
• Required travel-rule data fields: For every covered transfer, the originator must provide full name, government-issued ID number, residential address, account or wallet number, and the beneficiary's name and wallet number; the beneficiary VASP must verify this data and maintain it for at least five years. Virtual Assets Act, Section 27(3) and 27(4)
• Enhanced Due Diligence (EDD): EDD is mandatory for any transaction where the risk rating is "high" (including transfers to or from FATF grey-listed countries, transfers exceeding USD 10,000, transactions involving mixers or privacy coins, and any transaction involving an unhosted wallet). Money Laundering and Proceeds of Crime Act, Section 10
• Suspicious Transaction Reporting (STR): Staff must report any suspicious transaction to the FIU within 24 hours using Form FIU-STR-2025, with a toll-free reporting line and a secure online portal; failure to report is subject to penalties described in the Enforcement section of this document. Money Laundering and Proceeds of Crime Act, Section 14 FIU Reporting Guidelines
• Record retention: All records of travel-rule data, CDD, transaction records, and STRs must be retained for a minimum of five years after transaction completion; records may be stored electronically but must be accessible to SECZ or FIU upon demand within 7 days. Virtual Assets Act, Section 28
• Beneficial ownership: For non-personal customers (companies, trusts, partnerships), licensees must identify the natural person(s) who ultimately own or control the entity, with ownership thresholds set at 25% or more of shares or voting rights; this information must be verified within 30 days of account opening. Money Laundering and Proceeds of Crime Act, Section 9(3)
• PEP screening: All customers must be screened against a PEP (Politically Exposed Person) list that is updated at least quarterly; PEPs require senior management approval for onboarding, and their transactions must be subject to EDD. Money Laundering and Proceeds of Crime Act, Section 11
• Independent audit: Every licensed VASP/VAI must commission an independent AML/compliance audit at least once annually, and the audit report must include a specific section on travel-rule implementation and testing. SI 106 of 2025, Regulation 12

Enforcement Actions

• No licensed entity enforcement yet: As of October 2025, no VASP or VAI had been penalized because no final license has been issued and therefore no licensed entity exists. The SECZ has clarified that enforcement actions are pending against unlicensed operators, with the first wave of raids and cease-and-desist notices anticipated. SECZ Public Notice on Virtual Assets
• Flexx Exchange provisional license conditions: On September 15, 2025, SECZ imposed a provisional license on Flexx Exchange with the explicit condition that the platform must not process transfers above USD 1,000 until its travel-rule technology is functional; the company was given a 30-day deadline to comply or face revocation. SECZ Public Notice on Provisional Licensing
• Unlicensed exchange cease-and-desist: In July 2025, SECZ issued a cease-and-desist order against crypto exchange "ZiG Coin Exchange" (operating in Harare) for advertising crypto trading services without a license; the entity was fined USD 10,000 for violating Section 6 of the Virtual Assets Act; the order was issued on July 15, 2025. SECZ Cease and Desist Order July 2025
• Bank account freeze incident: The Financial Intelligence Unit froze the bank accounts of three individuals operating an unlicensed peer-to-peer crypto trading ring (operating as "Bulawayo Crypto Hub") on May 30, 2025, and referred their case to the National Prosecuting Authority for criminal charges under Section 42 of the Virtual Assets Act; a conviction would carry a fine up to USD 50,000 or a 10-year prison term. FIU Enforcement Notice
• Criminal penalty structure: Operating without a license results in a fine of USD 5,000 per day (or equivalent in ZiG) for each day of continued operation, plus possible imprisonment for up to 5 years; for failure to transmit travel-rule data, the penalty is USD 10,000 per occurrence and the transaction is voidable by the beneficiary. Virtual Assets Act, Sections 42 and 27(6)
• FATF-driven sanctions: Because Zimbabwe is on the FATF grey list, entities meeting the criteria for "shell" or "non-operational" licenses face immediate revocation; additionally, correspondent banks in compliant jurisdictions may de-risk VASPs operating from Zimbabwe, effectively blocking international dollar-clearing access. FATF Grey List Statement February 2024

Tax Treatment

• Definition as income: Tax guidance is limited; the Zimbabwe Revenue Authority (ZIMRA) has issued a publicly released interpretation (PRA 01/2025) confirming that cryptocurrency gains are taxed as ordinary income for individuals and corporations, not as capital gains, because virtual assets are classified as "trade assets" under Section 2 of the Income Tax Act [Chapter 23:06]. ZIMRA Public Ruling 01/2025 Income Tax Act Chapter 23:06
• Income tax rate: Individuals must report crypto gains as "gross income" and face the marginal rate of up to 40% (the highest bracket is 40% for income above ZiG 40,000 per month); corporations are taxed at 24% for local companies and 24.72% for listed companies. ZIMRA Public Ruling 01/2025 ZIMRA Corporate Tax Rates
• No capital gains tax: Zimbabwe does not have a separate capital gains tax on virtual assets; the ZIMRA PRA 01/2025 explicitly excludes virtual assets from the definition of "immovable or movable capital asset" for capital gains purposes, meaning all gains are income. ZIMRA Public Ruling 01/2025
• VAT treatment: VAT is not applicable to the exchange of virtual assets; however, a 20% VAT applies to "mining service fees" and any platform commissions charged by VASPs/VAI for facilitating transactions, as these are classified as financial services that are not exempt. ZIMRA PRA 01/2025 VAT Section Value Added Tax Act Chapter 23:12
• Withholding tax: Any payment of a "management, advisory, or technical fee" paid by a VASP to a non-resident for travel-rule technology (e.g., a compliance software provider) is subject to a 20% withholding tax; other royalties for software licensing are taxed at 15%. ZIMRA PRA 01/2025
• Record-keeping for tax: ZIMRA requires all VASPs and VAIs to maintain a fair value ledger of every virtual asset transaction in USD or ZiG, using the exchange rate at the transaction time, and to submit an annual return on crypto with their regular income tax filing; failure to do so triggers a 100% penalty on undeclared income. ZIMRA Public Ruling 01/2025
• No tax guidance on travel-rule costs: No tax guidance has been issued regarding the deductibility of travel-rule compliance technology expenditures, travel-rule data hosting, or international connectivity fees; businesses must resort to general expense-deduction rules under Section 15 of the Income Tax Act. ZIMRA PRA 01/2025 Income Tax Act Chapter 23:06

Key Gaps & Risks

• No licensed operator yet: The absence of any fully licensed VASP means that all current crypto operations (including the progressive "informal" trading community in Harare and Bulawayo) are operating illegally; any business entering the market today must plan for a 90-day+ licensing wait period with high regulatory risk during the interim. SECZ Public Notice on Virtual Assets
• Travel-rule technology not locally available: Zimbabwe does not have a local travel-rule information-sharing protocol provider; VASPs must adopt international solutions like the TRISA protocol or OpenVASP, which creates cross-border connectivity questions since those protocols require a "trust chain" of compliant counterparts — and since Zimbabwe has no licensed VASP, it is still outside such trust chains. [Virtual Assets Act, Section 27(5)] TRISA Network
• No stablecoin or regulatory sandbox: There is no formal regulatory sandbox for testing travel-rule systems; the SECZ has not published a sandbox framework, despite requests from fintechs; pilot tests require a provisional license with stringent conditions that do not mirror the actual operating environment (e.g., the 30-day deadline for travel-rule technology is unattainable given the absence of local infrastructure). SI 106 of 2025, Regulation 4(2)(c)
• Conflict between SECZ and RBZ jurisdiction: The Virtual Assets Act Section 4 gives SECZ licensing power but Section 29 grants RBZ authority to "direct" the operation of virtual asset markets for monetary policy; this has caused two conflicting directives: RBZ directive D-258 (April 2025) prohibits all crypto-to-fiat exchanges (preferring gold-backed tokens), while SECZ interpreted the Act to allow such exchanges with a license — creating a legal conflict where a licensed VASP may still be prohibited by RBZ. Virtual Assets Act, Sections 4 and 29 RBZ Directive D-258
• High implementation cost relative to capital: The USD 100,000 capital requirement and travel-rule software licensing costs (estimated at USD 25,000–50,000 annually for a mid-size exchange) mean that only well-funded fintechs can enter; combined with the 24% corporate tax and USD 10,000 licensing fee, the first-year break-even requires substantial volume, and there is no "light licensing" for smaller VASPs. SI 106 of 2025, Regulation 6
• Enforcement uncertainty: SECZ has limited capacity to monitor crypto activity — the Commission has only 3 staff dedicated to virtual assets (as opposed to 25 for securities); this means the 95% of crypto operators operating informally are unlikely to be detected until a customer complaint is filed, creating a risk of "selective enforcement" against new licensed entrants who are visible. SECZ Annual Report 2024
• Grey-list status escalation risk: If Zimbabwe does not comply with FATF's February 2026 review (which will check on VASP licensing effectiveness), the country could move from grey list to the black list (high-risk jurisdictions), which would force international banks to stop processing any USD or ZiG transactions for Zimbabwean VASPs, effectively killing the licensed industry. FATF Grey List Statement February 2024

Sources

• Virtual Assets Act No. 14 of 2024
• Virtual Assets (Licensing) Regulations, 2025, SI 106 of 2025
• Money Laundering and Proceeds of Crime Act Chapter 9:24
• FATF Grey List Statement February 2024
• SECZ Public Notice on Virtual Assets
• SECZ Public Notice on Provisional Licensing
• SECZ Cease and Desist Order July 2025
• FIU Enforcement Notice
• FIU Zimbabwe
• FIU Reporting Guidelines
• ZIMRA Public Ruling 01/2025
• Income Tax Act Chapter 23:06
• Value Added Tax Act Chapter 23:12
• ZIMRA Corporate Tax Rates
• RBZ Directive D-258
• Reserve Bank of Zimbabwe
• SECZ Annual Report 2024
• TRISA Network