Rwanda has enacted a standalone law to regulate virtual asset business.
Law No. 023/2026 of 25 May 2026 regulating virtual asset business was published in the Official Gazette on 28 May 2026 and came into force on the date of publication.
The law is comprehensive. It covers who can operate in Rwanda's virtual asset market, what services are regulated, how tokens and stablecoins can be issued, what consumer and investor protections apply, and what happens when rules are broken.
For businesses already active in this space, or considering entering it, the key question is no longer whether the sector is regulated. It is whether the activity falls within the law, and what licensing, approval, operational, and enforcement requirements may apply.
Why this law matters
Rwanda has been positioning itself as a financial services destination for international investment and cross-border transactions in Africa.
The virtual asset law fits within that wider direction. Rather than banning or ignoring digital assets, Rwanda has chosen to create a regulated framework for the sector while addressing risks such as money laundering, terrorist financing, fraud, consumer harm, and financial instability.
For any person or company dealing in cryptocurrencies, digital tokens, stablecoins, or related services in Rwanda, the law creates obligations that did not previously exist in a single consolidated text.
Who the law applies to
The law applies to two main categories of actors operating in Rwanda.
- Virtual asset service providers: Legal entities registered and licensed in Rwanda to provide virtual asset services as a business in or from Rwanda.
- Issuers: Legal entities authorised to offer virtual assets to the public or to a section of the public.
One important point is that natural persons are prohibited from conducting, or purporting to conduct, virtual asset business in Rwanda. In other words, virtual asset business is not an activity that individuals can carry out personally under the law. It is reserved for licensed or authorised legal entities.
The law also excludes certain activities from its scope, including logistics and technical assistance services, hardware manufacturing, software engineering services, and services to hardware wallet manufacturers. These exclusions are limited, so the nature of the activity remains important when assessing whether the law applies.
The regulator
The Capital Market Authority of Rwanda is the Regulatory Authority under the law.
Its role includes licensing, supervision, enforcement, investor and consumer protection, approval and supervision of virtual asset issuance, listing, and tokenisation of real-world assets.
The National Bank of Rwanda also has an important role where virtual asset activity touches monetary stability, financial stability, systemic risk, and the national payment system.
The law requires cooperation between the CMA and the Central Bank, including information sharing, joint risk assessments, and coordination where required. In practice, this means some virtual asset businesses may need to consider both CMA and BNR frameworks depending on the nature of their services.
Licensing
A legal entity that wants to provide virtual asset services in Rwanda must apply to the CMA for a licence.
The CMA may grant a licence where the applicant meets the conditions set under the law and related regulations. These include being incorporated in Rwanda or, if incorporated abroad, being registered and maintaining a local presence in Rwanda.
The applicant must also have a transparent ownership structure, disclose its beneficial owners, have sound governance arrangements, meet fit-and-proper standards for its board and senior management, have a business plan, and demonstrate the financial, technical, and operational capacity required for the intended services.
The law also requires virtual asset service providers to have anti-money laundering and counter-terrorism financing controls aligned with applicable standards.
The CMA may suspend or revoke a licence in certain circumstances, including serious regulatory breaches, false information, insolvency, fraud, or involvement in criminal activity. A provider that is dissatisfied with a suspension or revocation decision may appeal to the Independent Review Panel.
What services are regulated
The law lists a broad range of virtual asset services.
- Operating a digital platform for the issuance, listing, buying, selling, and trading of virtual assets
- Clearing and settlement of virtual asset transactions
- Exchanging fiat currency for virtual assets and virtual assets for fiat currency
- Exchanging one virtual asset for another
- Transferring virtual assets on behalf of customers
- Receiving and arranging orders
- Providing custody and administration
- Providing escrow services
- Providing investment advice or investment management relating to virtual assets
The CMA may also determine other virtual asset services by regulation. This means the scope can develop as the market develops.
Key prohibitions
- A natural person cannot conduct, or purport to conduct, virtual asset business in Rwanda.
- Virtual assets are not recognised as legal tender in Rwanda.
- Virtual assets cannot be used directly as a means of payment for goods, services, debts, or any other financial obligation unless authorised by the Central Bank.
- A legal entity cannot operate a virtual asset mining facility, a crypto or virtual asset ATM, or a mixer or tumbler service unless authorised by the CMA in collaboration with relevant authorities.
- Marketing activity relating to virtual assets is restricted to licensed service providers and approved issuers.
Tokenisation, initial offerings, and stablecoins
The law creates a framework for the issuance of virtual assets, including tokenisation of real-world assets, initial virtual asset offerings, and stablecoins.
- Tokenisation of real-world assets: Requires CMA approval, must be 100% collateralised, underlying asset must be valued by a qualified valuer and ring-fenced; sovereign assets, public infrastructure, personally identifiable information, artworks, and other difficult-to-value/enforce assets are ineligible.
- Initial virtual asset offerings: Only by legal entities with CMA approval; requires a white paper with details enabling informed investor decisions including features, target investor, rights, risks, technology, and tax.
- Stablecoins: Require prior CMA approval, reserve assets, qualified valuation, full collateralisation, independent audit, custody by a licensed custodian, and segregation of reserves. Algorithmic stablecoins are excluded from the law's definition.
Operational obligations
Once licensed, virtual asset service providers are subject to ongoing obligations:
- Reporting to the CMA on services, account activity, transactions, fraud, complaints, and suspicious activity.
- Complying with transfer rules for transfers meeting a set threshold, including secure transmission of originator and beneficiary information.
- Consumer/investor protections such as required advice, clear cost disclosures, anti-fraud systems, and accurate product information.
- Marketing materials must include a prominent risk disclosure/warning.
- Maintaining a prescribed minimum liquidity ratio.
- Adopting robust technology and cybersecurity controls; mandated periodic independent audits of security frameworks.
The regulatory sandbox
The law creates a regulatory sandbox for innovative virtual asset business models not yet covered under the law.
The sandbox allows models to be tested under supervision. CMA and Central Bank frameworks determine sandbox application/eligibility. Successful tests may lead to full licensing.
Practical considerations for affected businesses
- Existing businesses must assess whether activities now require a licence, approval, or changes to their operating model.
- New entrants must plan for licensing and operational requirements from the start, including governance, AML, ownership transparency, and technical controls.
- Issuers face strict requirements on product structure, disclosures, custody, valuation, and audit.
- Ongoing obligations for licensed service providers include AML controls, reporting, market conduct, and robust technology/cybersecurity practices.
- Marketing virtual assets in Rwanda is limited to licensed or approved actors.
The law came into force on 28 May 2026. Virtual asset activity in Rwanda is now within a defined and enforceable regulatory framework.
Conclusion
Rwanda's virtual asset law marks a major step in the formal regulation of digital assets.
The law does not treat virtual assets as legal tender, and it does not give the sector a free pass. Instead, it creates a controlled framework for licensing, issuance, supervision, consumer protection, technology risk, and enforcement.
For businesses, investors, platforms, and issuers, the message is clear: Rwanda's virtual asset market is now regulated, and participation in that market depends on understanding the legal framework that now applies.
Disclaimer
This article is for general informational purposes only and does not constitute legal or regulatory advice. All references are to Law No. 023/2026 of 25 May 2026 regulating virtual asset business as published in the Official Gazette on 28 May 2026. Specific advice should be obtained from a qualified professional based on individual circumstances.
Need clarity on Rwanda's virtual asset regulatory framework?
The virtual asset law affects exchanges, issuers, platforms, and any business touching digital tokens or stablecoins in Rwanda. The licensing and operational requirements are now concrete and enforceable. The question worth answering is not whether this sector is regulated — it is — but what it means for your business model, your governance, and your path to compliance. That is the conversation we work through with our clients at Andersen Rwanda, grounded in the actual language and requirements of the law.