Rwanda

**Law N° 060/2021 of 14/10/2021 on Preventing and Combating Money Laundering and Financing of Terrorism:** This is the overarching AML/CFT law in Rwanda. It establishes the legal framework for identifying, reporting, and preventing money laundering and terrorist financing. It defines "reporting persons" broadly to include any person or entity that, by virtue of their activities, may be exposed to ML/TF risks, which can encompass VASPs even if not explicitly named.

**Ministerial Order N° 001/2022 of 28/01/2022 determining requirements for combating money laundering and financing of terrorism:** This order specifies the general AML/CFT compliance requirements for reporting persons.

**Ministerial Order N° 002/2022 of 28/01/2022 determining procedures for combating money laundering and financing of terrorism:** This order details the procedural aspects of AML/CFT compliance.

**National Bank of Rwanda (BNR) Circulars and Guidelines:** The BNR, as the central bank and financial regulator, has issued warnings regarding the risks associated with cryptocurrencies, underscoring the need for AML/CFT compliance should they operate within Rwanda's financial ecosystem. While not specific VASP licensing, these reinforce the general AML/CFT obligations.

**Identification and Verification of Customers:**

**For Individuals:** Obtaining and verifying name, address, date of birth, nationality, national identification number (e.g., Rwandan ID card, passport number), and any other unique identifiers. This typically involves documentary verification (e.g., valid ID document) and, where appropriate, non-documentary methods.

**For Legal Entities (Companies, Corporations, Trusts):** Obtaining and verifying the entity's name, legal form, address, registration number, articles of incorporation, bylaws, and proof of existence. Identifying and verifying the identity of beneficial owners (individuals who ultimately own or control the entity, typically 25% ownership threshold or control through other means), as well as persons acting on behalf of the entity (e.g., directors, authorized signatories).

**Understanding the Purpose and Intended Nature of the Business Relationship:** VASPs must understand why the customer wants to use their services and the anticipated level and type of activity.

**Ongoing Monitoring:** Continuously monitoring the business relationship and transactions undertaken by customers to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes keeping customer information up-to-date.

**Risk-Based Approach:** Applying CDD measures based on a risk assessment. This means applying enhanced due diligence (EDD) for higher-risk customers (e.g., Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, complex or unusually large transactions) and simplified due diligence (SDD) for lower-risk customers (if permitted and justified). Due to the inherent risks of virtual assets, most VASP activities would generally require standard or enhanced CDD.

**Reporting Threshold:** There is no minimum monetary threshold for reporting suspicious transactions. Any transaction, regardless of amount, where there are reasonable grounds to suspect that it may be related to money laundering or terrorist financing, must be reported.

**Content of Report:** STRs must contain comprehensive details about the customer, the transaction(s), and the reasons for the suspicion.

**Timing:** Reports must be made promptly, typically within a specified number of business days (e.g., 2-5 working days) of forming the suspicion.

**No Tipping-Off:** VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an investigation is underway.

**Customer Identification Records:** All documents and information obtained during the CDD process (e.g., copies of identification documents, beneficial ownership information).

**Transaction Records:** Records of all transactions undertaken, sufficient to permit reconstruction of individual transactions (e.g., sender and receiver details, amounts, type of virtual asset, transaction hash/ID, date and time).

**Business Relationship Records:** Records pertaining to the business relationship, correspondence, and decisions made regarding the customer's risk profile.

**Suspicious Transaction Reports (STRs):** Copies of all STRs filed and any internal documentation supporting the decision to file (or not to file).

**Duration:** Records must generally be kept for a period of at least **five (5) years** after the end of the business relationship or the date of the transaction.

**Financial Intelligence Centre (FIC) of Rwanda**

**Role:** The FIC is Rwanda's Financial Intelligence Unit (FIU). It is responsible for receiving, analyzing, and disseminating suspicious transaction reports to law enforcement agencies. It also provides guidance and oversight on AML/CFT compliance for reporting persons.

**National Bank of Rwanda (BNR)**

**Role:** Central bank and primary financial sector regulator. While not directly licensing VASPs currently, its guidance and pronouncements on virtual assets influence the regulatory environment.

**Central Bank of Rwanda (BNR) - Official Website:** The BNR is the primary financial regulator. Their official statements and publications are the most authoritative source.

**Financial Sector Law (General):** Financial activities are generally governed by laws such as:

**Law N° 40/2017 of 27/10/2017 Governing the Organization of Banking:** This law, and other related financial sector laws (e.g., for microfinance, insurance), provide the general framework for financial institutions. Currently, these laws do not explicitly cover cryptocurrency custody.

**Status:** There are **no specific, dedicated licensing requirements** for digital asset custodians in Rwanda. Firms seeking to offer custody services would likely operate in a grey area, potentially falling under existing financial services laws if their activities are deemed to constitute banking, payment services, or other regulated financial activities. However, the application of such laws to novel crypto custody models is unclear without specific interpretation or amendment.

The BNR has not issued a "crypto custody license."

**Status:** There are **no specific rules or mandates** for the segregation of client digital assets from a custodian's proprietary assets. In traditional finance, principles of client asset protection and segregation are fundamental. If and when Rwanda introduces specific crypto regulations, it is highly likely that such rules would be a core component, often mirroring practices in securities or banking.

**Status:** There are **no specific insurance or bonding requirements** for digital asset custodians. For traditional financial institutions, various capital adequacy, deposit insurance, or bonding requirements exist based on the type of license. Without a dedicated crypto custody license, these would not apply directly to crypto-native custodians.

**Status:** There are **no specific mandates** regarding the use of cold storage (offline storage) for digital assets held in custody. Best practices in the industry universally recommend robust security measures, including cold storage for a significant portion of assets, multi-signature wallets, and robust key management. When regulations are eventually introduced, technical security standards, including storage requirements, are expected to be included.

**Status:** There is **no legal definition** for a "qualified custodian" in the context of digital assets in Rwandan law. The concept of a "qualified custodian" typically arises in jurisdictions with mature securities or investment advisory regulations (e.g., the SEC in the U.S.) to ensure that client assets are held by reputable and regulated entities.

**Status:** While there is **no publicly available draft legislation specifically on digital asset custody**, Rwanda, like many countries, is under increasing pressure from international bodies such as the Financial Action Task Force (FATF) to regulate Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs). This includes rules for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF).

The BNR has shown an interest in exploring new financial technologies, including potentially a Central Bank Digital Currency (CBDC), and has a fintech sandbox initiative. This indicates an openness to understanding and potentially regulating the digital asset space in the future.

It is highly probable that discussions are ongoing within the BNR and other government bodies regarding a comprehensive framework for digital assets, which would invariably include provisions for custody services, AML/CFT compliance, and consumer protection. However, the timeline and specific content are not yet public.

**Law No. 008/2020 of 08/07/2020 on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation (AML/CFT-P):** This is the cornerstone legislation. It establishes the Financial Intelligence Centre (FIC) as the primary body for receiving and analyzing suspicious transaction reports (STRs) and provides the framework for identifying and sanctioning financial crimes. This law explicitly mandates compliance with international sanctions, particularly those issued by the United Nations Security Council (UNSC).

**Legal Reference:** Law No. 008/2020 of 08/07/2020 on AML/CFT-P (See particularly Articles 2, 3, 22, 23 regarding reporting institutions, financing of terrorism and proliferation, and international cooperation).

**Law No. 008/2021 of 16/02/2021 Governing Payment Systems:** This law provides a framework for licensing and oversight of payment service providers. While not specific to crypto, it lays the groundwork for how VASPs might be regulated and licensed, extending AML/CFT obligations to them. The National Bank of Rwanda (BNR) is the primary regulator for payment systems and is actively working on a comprehensive framework for digital assets.

**Legal Reference:** Law No. 008/2021 of 16/02/2021 Governing Payment Systems

**Regulations and Directives from the National Bank of Rwanda (BNR):** The BNR, as the central bank, issues directives and regulations that implement the AML/CFT-P law and govern financial institutions. As the regulatory framework for VASPs develops, specific BNR guidance will detail their obligations.

**BNR Website:** National Bank of Rwanda

**Financial Intelligence Centre (FIC) Directives:** The FIC provides guidance to reporting institutions on AML/CFT compliance, including sanctions screening.

**FIC Website:** Rwanda Financial Intelligence Centre

**Requirements for VASPs:** Once formally regulated, VASPs in Rwanda (or those dealing with Rwandan entities) must:

Screen all customers, beneficial owners, and counterparties against the **UN Security Council Consolidated List** and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).

Immediately freeze funds and other assets of designated individuals and entities.

Report any hits or frozen assets to the FIC without delay.

Refrain from making funds or economic resources available, directly or indirectly, to sanctioned parties.

**Legal Reference:** UN Security Council Sanctions Committees (Lists and Resolutions): https://www.un.org/securitycouncil/sanctions/information

Dealing with U.S. persons (citizens, residents, entities, branches globally).

Utilizing U.S.-based blockchain analytics tools or other U.S. services.

Operating in whole or in part within the U.S.

**Requirements for VASPs:** Due to the risk of secondary sanctions and disruption of international financial services, prudent VASPs operating in Rwanda should:

Screen all customers, beneficial owners, and transactions against the **OFAC Specially Designated Nationals (SDN) and Blocked Persons List** and other relevant OFAC sanctions lists (e.g., for specific countries or programs like Cuba, Iran, North Korea, Syria, Venezuela, Russia/Ukraine).

Block transactions and freeze assets of designated individuals and entities.

Refrain from engaging in any activity that could be considered a violation or circumvention of OFAC sanctions.

**Legal Reference:** U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC): https://home.treasury.gov/policy-issues/office-of-foreign-assets-control-sanctions-programs-and-information

Persons and entities incorporated or constituted under the law of an EU Member State.

Any person or entity in respect of business done in whole or in part within the European Union.

**Requirements for VASPs:** VASPs in Rwanda dealing with EU persons or entities, or otherwise having an EU nexus, should:

Screen against the **EU Consolidated Financial Sanctions List**.

Freeze funds and economic resources of designated persons and entities.

Prevent funds or economic resources from being made available to them.

**Legal Reference:** EU Sanctions Map and Consolidated List: https://www.sanctionsmap.eu/

**Customer Due Diligence (CDD) and Know Your Customer (KYC):** Perform thorough CDD on all customers, including identifying beneficial owners. This is the foundation for effective sanctions screening.

**Onboarding:** Screen new customers and their beneficial owners against all relevant sanctions lists (UN, OFAC, EU).

**Ongoing Monitoring:** Regularly re-screen existing customer bases and monitor for changes in sanctions lists.

**Transaction Monitoring:** Screen transaction counterparties and involved entities in real-time or near real-time, especially for high-value or high-risk transactions.

**Tools and Technology:** Utilize reputable sanctions screening software that can handle various lists and languages, and integrate with blockchain analytics tools for tracing funds.

**Positive Match Resolution:** Establish clear procedures for investigating potential matches, escalating to compliance officers, and taking appropriate action (e.g., blocking funds, filing reports).

**Record-Keeping:** Maintain detailed records of all screening activities, hits, investigations, and reports filed.

**UN Sanctions:** Countries subject to comprehensive UN sanctions (e.g., North Korea, Iran in certain contexts).

**OFAC Sanctions:** Countries subject to comprehensive U.S. embargos (e.g., Cuba, Iran, North Korea, Syria, regions of Ukraine, Venezuela).

**EU Sanctions:** Countries or regions subject to EU restrictive measures (e.g., specific regions in Ukraine, Belarus, Myanmar, Syria, North Korea, Iran, Venezuela).

**Administrative Penalties:** The competent supervisory authority (likely the BNR or FIC) can impose administrative fines, revoke licenses, or restrict operations.

**Criminal Penalties:** Individuals or entities found guilty of money laundering, financing of terrorism, or proliferation can face severe criminal penalties, including:

**Imprisonment:** For individuals, ranging from several years to life imprisonment, depending on the severity of the offense.

**Financial Fines:** Substantial fines for both individuals and legal entities.

**Confiscation of Assets:** Assets involved in or derived from illicit activities can be confiscated.

**Primary Sanctions List:** Rwandan financial institutions and, by extension, future licensed VASPs, are primarily required to implement the **UN Security Council Consolidated List** and other specific UN sanctions regimes as mandated by the Law No. 008/2020 on AML/CFT-P.

**Partial/Cautionary:** Rwanda does not have a comprehensive regulatory framework for cryptocurrencies, nor does it impose an outright ban. Instead, it maintains a cautionary stance, primarily through warnings from the central bank, highlighting the risks associated with virtual assets. The focus is currently on consumer protection, financial stability, and leveraging existing AML/CFT legislation.

**Developing:** There is an ongoing recognition of fintech innovation, and discussions are underway regarding future regulatory frameworks that might encompass virtual assets.

**National Bank of Rwanda (BNR):**

**Role:** As the central bank, the BNR is the primary financial regulator responsible for monetary policy, financial stability, and the oversight of financial institutions. It has issued public notices regarding the risks of cryptocurrencies.

**URL:** National Bank of Rwanda Official Website

**Rwanda Financial Intelligence Centre (FIC):**

**Role:** The FIC is Rwanda's anti-money laundering and combating the financing of terrorism (AML/CFT) agency. It is responsible for receiving, analyzing, and disseminating financial intelligence to combat money laundering and terrorist financing. Any future regulation of virtual assets will likely involve the FIC to ensure compliance with AML/CFT standards.

**URL:** While the FIC doesn't have a standalone public website, information on its mandate and operations is typically found on the Ministry of Justice or Ministry of Finance websites.

**Ministry of Finance and Economic Planning (MINECOFIN):**

**Role:** MINECOFIN is responsible for overall fiscal and economic policy, and would play a role in developing any overarching national policy or legislation related to virtual assets.

**URL:** Ministry of Finance and Economic Planning

**BNR Public Notices/Warnings (e.g., December 2017/January 2018):**

**Content:** The National Bank of Rwanda (BNR) issued public warnings against the use of cryptocurrencies, highlighting their volatile nature, potential for fraud, money laundering, and lack of legal tender status. These notices advise the public against investing in or trading virtual currencies, emphasizing that they are not regulated by the BNR and do not fall under its supervision.

**Date:** Circa December 2017 / January 2018 (The exact date might vary slightly depending on the specific publication, but this period marks the BNR's first public cautionary statements).

**Reference:** While a direct, stable URL to the specific 2017/2018 circular can be difficult to find due to website updates, the BNR's official position is consistently maintained in its public communications and can be inferred from news archives and BNR publications. General BNR publications can be found on their website: BNR Publications

**Law N° 19/2013 of 25/03/2013 on Prevention and Punishment of Money Laundering and Financing of Terrorism, amended by Law N° 35/2019 of 24/07/2019:**

**Content:** This law provides the general legal framework for AML/CFT in Rwanda. While it doesn't explicitly mention "virtual assets," its broad definitions and provisions related to financial transactions, reporting obligations for suspicious activities, and asset forfeiture could potentially be interpreted to cover illicit activities involving virtual assets. As FATF recommendations evolve to include VAs, this law serves as the foundation for future specific regulations.

**Date:** Original law from 2013, significant amendment in 2019.

**Reference:** This law is available in the Official Gazette of the Republic of Rwanda. Searching for "Official Gazette Rwanda Law N° 35/2019" would typically lead to its publication. A general source for Rwandan laws is the Ministry of Justice or Rwanda Law Reform Commission portal.

**Unregulated but Not Illegal:** Crypto trading and the operation of crypto exchanges are **not explicitly prohibited** in Rwanda, but they are also **not formally regulated or licensed**. This means they operate in a legal "grey area."

**High Risk Warnings:** The National Bank of Rwanda has consistently advised the public that engaging in virtual asset activities carries significant risks, including price volatility, lack of consumer protection, potential for fraud, and the absence of any regulatory recourse in case of loss.

**No Specific Licensing:** There is currently no specific licensing regime for Virtual Asset Service Providers (VASPs), including exchanges, custodians, or issuers of virtual assets. Entities engaging in such activities do so outside of the formal financial regulatory framework.

**AML/CFT Scrutiny:** Any entity or individual involved in virtual asset transactions would still be subject to general AML/CFT scrutiny under the existing laws, particularly if suspicious activities are detected by traditional financial institutions (which are regulated).

**Law N°003/2020 of 20/02/2020 on Preventing and Laundering and Combating the Financing of Terrorism and Proliferation of Weapons of Mass Destruction.**

**VASP-to-VASP Transfers:** For transfers between two Virtual Asset Service Providers (VASPs), there is **no threshold**. The full originator and beneficiary information must be collected and transmitted regardless of the amount.

**De Minimis Threshold (for certain scenarios):** While the law requires information for all transfers, FATF guidance allows for a de minimis threshold (typically **USD/EUR 1,000**) below which the receiving VASP *may* not need to obtain the originator information *unless* there is suspicion of ML/TF or the transfer is associated with a higher-risk scenario. However, the *originating VASP* still has obligations to collect and transmit this information. Rwanda's Article 23 generally mandates information for *all* transfers, placing the burden on both originating and receiving entities. Further specific implementing regulations or guidance from the National Bank of Rwanda (BNR) or the Financial Intelligence Centre (FIC) would clarify any exact de minimis for specific types of lower-risk transactions, but the default expectation is full compliance.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.

Name (natural person) or Legal name (legal person)

National identity number (for natural persons) or Legal entity identifier (for legal persons)

Virtual asset wallet address or unique transaction identifier

**Administrative Sanctions:** Imposed by regulatory bodies like the National Bank of Rwanda (BNR) or the Financial Intelligence Centre (FIC), which can include warnings, fines, suspension of licenses, or withdrawal of licenses.

**Fines:** Significant monetary penalties for legal persons, potentially ranging from millions to hundreds of millions of Rwandan Francs (RWF), depending on the severity and nature of the breach.

**Imprisonment:** Individuals found responsible for non-compliance, especially in cases of willful negligence or involvement in money laundering/terrorism financing, can face terms of imprisonment.

Failure to report suspicious transactions.

Failure to implement internal controls and procedures.

**Evolving Regulatory Framework:** Rwanda's regulatory framework for virtual assets is still developing. While the National Bank of Rwanda (BNR) has issued warnings and statements regarding the risks of cryptocurrencies, comprehensive legislation specifically targeting Virtual Asset Service Providers (VASPs) and detailing licensing requirements and specific enforcement mechanisms is still in progress.

**Focus on Warnings and Consumer Protection:** The BNR's primary approach has been to issue public warnings about the unregulated nature of cryptocurrencies, their volatility, and the risks of fraud and money laundering. This is a preventative measure rather than reactive enforcement against specific licensed entities (as there are few, if any, formally licensed crypto businesses operating under a specific crypto regulatory regime in Rwanda currently).

**Lack of Formal Licensing Regime:** Without a well-established licensing regime for crypto businesses, enforcement actions would more likely fall under general financial laws (e.g., anti-money laundering, fraud) rather than specific crypto regulatory breaches. Any related cases might be handled by criminal law enforcement rather than financial regulators as "enforcement actions" against a specific crypto business.

**Limited Market Size:** The cryptocurrency market in Rwanda may not yet be large enough to attract the scale of illicit activity or the number of unregulated operators that would trigger frequent, large-scale, and publicly reported enforcement actions seen in more mature or permissive crypto jurisdictions.

**Regulator:** National Bank of Rwanda (BNR)

**General Stance/Violation Type:** Public warnings against the use of cryptocurrencies due to their unregulated nature, high volatility, lack of legal tender status, and potential for fraud and money laundering. This can be broadly seen as a "pre-emptive enforcement" or "risk mitigation" strategy.

**Entity Targeted:** The general public and potential investors.

**Penalty Amount:** Not applicable, as these are warnings, not fines against specific entities.

**Date:** Ongoing, with several statements issued over the years.

**Outcome:** Increased public awareness about crypto risks and BNR's position. Discouragement of participation in unregulated crypto schemes.

**National Bank of Rwanda (BNR) on Virtual Currencies:** The BNR has consistently stated that virtual currencies are not legal tender in Rwanda and has warned against their risks.

**Source URL (Example of BNR's official statements regarding financial stability and emerging risks, which includes virtual assets):** It's common for central banks to embed these warnings in their Financial Stability Reports or official press releases. While a single "enforcement action" URL isn't available, the BNR's general position is clear through its publications. You would typically find this mentioned in their **Financial Stability Reports** or general **Press Releases** section.

*Finding a direct BNR URL for a specific "warning" is challenging as they are often integrated into broader reports or general statements. A good starting point would be the BNR's official website:* https://www.bnr.rw/

*Searching BNR's site for "virtual currency," "cryptocurrency," or "digital assets" within their "Publications" or "News" section would reveal their long-standing cautionary statements.* For instance, their financial stability reports often include sections on emerging risks, including crypto.

**News Articles Reporting BNR's Stance:** Various news outlets have reported on the BNR's cautionary position on cryptocurrencies.

**Example (2022) - BNR warns against crypto, but acknowledges blockchain potential:**

**Entity Targeted:** General public / Potential users of crypto

**Violation Type:** General warning against unregulated financial activities and associated risks.

**Date:** Reported in early 2022 (e.g., February/March 2022)

https://www.newtimes.co.rw/article/185249/News/bnr-warns-rwandans-against-cryptocurrency-risks (The New Times, published March 2, 2022)