Custodial wallet / SaaS in Rwanda

Law N° 060/2021 of 14/10/2021 on Preventing and Combating Money Laundering and Financing of Terrorism: This is the overarching AML/CFT law in Rwanda. It establishes the legal framework for identifying, reporting, and preventing money laundering and terrorist financing. It defines "reporting persons" broadly to include any person or entity that, by virtue of their activities, may be exposed to ML/TF risks, which can encompass VASPs even if not explicitly named.

Ministerial Order N° 001/2022 of 28/01/2022 determining requirements for combating money laundering and financing of terrorism: This order specifies the general AML/CFT compliance requirements for reporting persons.

Ministerial Order N° 002/2022 of 28/01/2022 determining procedures for combating money laundering and financing of terrorism: This order details the procedural aspects of AML/CFT compliance.

National Bank of Rwanda (BNR) Circulars and Guidelines: The BNR, as the central bank and financial regulator, has issued warnings regarding the risks associated with cryptocurrencies, underscoring the need for AML/CFT compliance should they operate within Rwanda's financial ecosystem. While not specific VASP licensing, these reinforce the general AML/CFT obligations.

Identification and Verification of Customers:

For Individuals: Obtaining and verifying name, address, date of birth, nationality, national identification number (e.g., Rwandan ID card, passport number), and any other unique identifiers. This typically involves documentary verification (e.g., valid ID document) and, where appropriate, non-documentary methods.

For Legal Entities (Companies, Corporations, Trusts): Obtaining and verifying the entity's name, legal form, address, registration number, articles of incorporation, bylaws, and proof of existence. Identifying and verifying the identity of beneficial owners (individuals who ultimately own or control the entity, typically 25% ownership threshold or control through other means), as well as persons acting on behalf of the entity (e.g., directors, authorized signatories).

Understanding the Purpose and Intended Nature of the Business Relationship: VASPs must understand why the customer wants to use their services and the anticipated level and type of activity.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions undertaken by customers to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes keeping customer information up-to-date.

Risk-Based Approach: Applying CDD measures based on a risk assessment. This means applying enhanced due diligence (EDD) for higher-risk customers (e.g., Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, complex or unusually large transactions) and simplified due diligence (SDD) for lower-risk customers (if permitted and justified). Due to the inherent risks of virtual assets, most VASP activities would generally require standard or enhanced CDD.

Reporting Threshold: There is no minimum monetary threshold for reporting suspicious transactions. Any transaction, regardless of amount, where there are reasonable grounds to suspect that it may be related to money laundering or terrorist financing, must be reported.

Content of Report: STRs must contain comprehensive details about the customer, the transaction(s), and the reasons for the suspicion.

Timing: Reports must be made promptly, typically within a specified number of business days (e.g., 2-5 working days) of forming the suspicion.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an investigation is underway.

Customer Identification Records: All documents and information obtained during the CDD process (e.g., copies of identification documents, beneficial ownership information).

Transaction Records: Records of all transactions undertaken, sufficient to permit reconstruction of individual transactions (e.g., sender and receiver details, amounts, type of virtual asset, transaction hash/ID, date and time).

Business Relationship Records: Records pertaining to the business relationship, correspondence, and decisions made regarding the customer's risk profile.

Suspicious Transaction Reports (STRs): Copies of all STRs filed and any internal documentation supporting the decision to file (or not to file).

Duration: Records must generally be kept for a period of at least five (5) years after the end of the business relationship or the date of the transaction.

Financial Intelligence Centre (FIC) of Rwanda

National Bank of Rwanda (BNR) Circulars and Guidelines: The BNR, as the central bank and financial regulator, has issued warnings regarding the risks associated with cryptocurrencies, underscoring the need for AML/CFT compliance should they operate within Rwanda's financial ecosystem. While not specific VASP licensing, these reinforce the general AML/CFT obligations.

Central Bank of Rwanda (BNR) - Official Website: The BNR is the primary financial regulator. Their official statements and publications are the most authoritative source.

Law No. 008/2020 of 08/07/2020 on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation (AML/CFT-P): This is the cornerstone legislation. It establishes the Financial Intelligence Centre (FIC) as the primary body for receiving and analyzing suspicious transaction reports (STRs) and provides the framework for identifying and sanctioning financial crimes. This law explicitly mandates compliance with international sanctions, particularly those issued by the United Nations Security Council (UNSC).

Law No. 008/2021 of 16/02/2021 Governing Payment Systems: This law provides a framework for licensing and oversight of payment service providers. While not specific to crypto, it lays the groundwork for how VASPs might be regulated and licensed, extending AML/CFT obligations to them. The National Bank of Rwanda (BNR) is the primary regulator for payment systems and is actively working on a comprehensive framework for digital assets.

Requirements for VASPs: Once formally regulated, VASPs in Rwanda (or those dealing with Rwandan entities) must:

Screen all customers, beneficial owners, and counterparties against the UN Security Council Consolidated List and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).

Immediately freeze funds and other assets of designated individuals and entities.

Report any hits or frozen assets to the FIC without delay.

Refrain from making funds or economic resources available, directly or indirectly, to sanctioned parties.

Dealing with U.S. persons (citizens, residents, entities, branches globally).

Screen all customers, beneficial owners, and counterparties against the UN Security Council Consolidated List and other specific UN sanctions lists (e.g., for specific countries or individuals/entities designated for terrorism financing, proliferation, etc.).

Block transactions and freeze assets of designated individuals and entities.

Refrain from engaging in any activity that could be considered a violation or circumvention of OFAC sanctions.

Evolving Regulatory Framework: Rwanda's regulatory framework for virtual assets is still developing. While the National Bank of Rwanda (BNR) has issued warnings and statements regarding the risks of cryptocurrencies, comprehensive legislation specifically targeting Virtual Asset Service Providers (VASPs) and detailing licensing requirements and specific enforcement mechanisms is still in progress.

Focus on Warnings and Consumer Protection: The BNR's primary approach has been to issue public warnings about the unregulated nature of cryptocurrencies, their volatility, and the risks of fraud and money laundering. This is a preventative measure rather than reactive enforcement against specific licensed entities (as there are few, if any, formally licensed crypto businesses operating under a specific crypto regulatory regime in Rwanda currently).

Lack of Formal Licensing Regime: Without a well-established licensing regime for crypto businesses, enforcement actions would more likely fall under general financial laws (e.g., anti-money laundering, fraud) rather than specific crypto regulatory breaches. Any related cases might be handled by criminal law enforcement rather than financial regulators as "enforcement actions" against a specific crypto business.

Limited Market Size: The cryptocurrency market in Rwanda may not yet be large enough to attract the scale of illicit activity or the number of unregulated operators that would trigger frequent, large-scale, and publicly reported enforcement actions seen in more mature or permissive crypto jurisdictions.

National Bank of Rwanda (BNR) on Virtual Currencies: The BNR has consistently stated that virtual currencies are not legal tender in Rwanda and has warned against their risks.

General Stance/Violation Type: Public warnings against the use of cryptocurrencies due to their unregulated nature, high volatility, lack of legal tender status, and potential for fraud and money laundering. This can be broadly seen as a "pre-emptive enforcement" or "risk mitigation" strategy.