Rwanda Cryptocurrency Regulation: The 2026 Virtual Asset Law, Licensing and What It Means

Rwanda entered a new era of cryptocurrency regulation in 2026. Law nº 023/2026 regulating virtual asset business was published in the Official Gazette on 28 May 2026.

The law creates Rwanda's first dedicated framework for virtual asset business. It covers virtual asset service providers, issuers, licensing, supervision, consumer protection, market conduct and enforcement.

Rwanda is also one of Africa's most financially connected digital economies. Rwanda's 2024 FinScope Survey found that 96% of adults, or about 7.8 million people, were financially included.

Formal financial inclusion reached 92%, or about 7.5 million people. About 77% of adults had a mobile wallet registered in their own name. About 86%, or 6.9 million adults, had used mobile money.

Those figures do not measure crypto adoption.

They show the digital-finance environment in which Rwanda's virtual asset market is developing.

The Capital Market Authority's 2024–2025 Annual Report said Rwanda's virtual asset sector remained small and risks were limited. It also said the sector was growing rapidly and that the lack of a regulatory framework increased vulnerability.

The response was Law nº 023/2026.

The Capital Market Authority of Rwanda is the main regulatory authority under the new law.

The biggest question now is no longer whether Rwanda plans to regulate crypto.

Rwanda has enacted the law.

The next stage is implementation.

Rwanda Crypto Regulation at a Glance

• Law nº 023/2026 was published on 28 May 2026.
• Rwanda now has a dedicated law regulating virtual asset business.
• The Capital Market Authority is the main regulatory authority.
• Regulated virtual asset businesses require licensing or approval where required by the law.
• The framework covers virtual asset service providers and issuers operating in or from Rwanda.
• The law addresses consumer protection, market integrity and financial stability.
• It addresses money laundering, terrorist financing and proliferation financing risks.
• It provides for a regulatory sandbox.
• It addresses virtual asset issuance, stablecoins and tokenisation.
• It includes administrative sanctions and criminal offences.

The key distinction is simple.

The law is in force.

Detailed operational requirements can depend on implementing regulations and regulatory processes.

What Is Law nº 023/2026?

Law nº 023/2026 of 25 May 2026 is Rwanda's dedicated law regulating virtual asset business.

It was published in the Official Gazette on 28 May 2026.

The CMA's regulatory framework page now lists it as the Law Regulating Virtual Asset Business.

The framework is designed around several major objectives:

• Consumer and investor protection.
• Market integrity.
• Financial stability.
• Prevention of money laundering.
• Prevention of terrorist financing.
• Prevention of proliferation financing.
• Responsible innovation.

The CMA's 2024–2025 Annual Report says the framework followed Rwanda's virtual asset and VASP national risk assessment, AML/CFT work, international standards and stakeholder consultations.

The Law Is Broader Than Bitcoin

The framework covers more than buying and selling Bitcoin.

It addresses virtual asset business.

It also addresses areas such as:

• Virtual asset issuance.
• Exchange and other virtual asset services.
• Transfers.
• Custody and administration.
• Stablecoins.
• Tokenisation of real-world assets.
• Market conduct.
• Technology and information security.
• Regulatory supervision.

Rwanda is therefore building a market framework.

It is not simply creating rules for crypto trading.

Who Regulates Cryptocurrency in Rwanda?

Capital Market Authority of Rwanda

The Official Gazette text designates the Capital Market Authority as the regulatory authority for virtual asset business.

The CMA's functions include regulating and supervising relevant market activity.

Its role includes areas connected with:

• Approval and supervision of virtual asset issuance.
• Virtual asset listing.
• Tokenisation of real-world assets.
• Identification and supervision of virtual asset service providers.
• Licensing and enforcement.
• Consumer and investor protection.

National Bank of Rwanda

The National Bank of Rwanda remains important where virtual assets connect with:

• Payment systems.
• Monetary policy.
• Financial stability.
• The wider financial sector.

The CMA's 2024–2025 Annual Report says the framework provides for cooperation with the National Bank of Rwanda where virtual asset operations connect with the wider financial system.

A business should therefore assess its full product.

A payment product can raise different questions from a pure technology service.

Do Crypto Businesses Need a Licence in Rwanda?

Yes, regulated virtual asset business is subject to a licensing framework.

During the legislative process, the Rwandan Parliament said that a legally registered entity wishing to provide digital asset services must first obtain a licence from the Capital Market Authority.

The final law was then published on 28 May 2026.

The Primary Law and Implementing Regulations Are Different

The primary law establishes the legal framework.

Implementing regulations can provide operational detail.

That can include:

• Licence procedures.
• Governance standards.
• Prudential requirements.
• Capital requirements.
• Ongoing reporting.
• Technical standards.
• Fees.
• Detailed compliance obligations.

The CMA said in May 2026 that implementation requires technical knowledge and coordination among institutions and market participants.

Businesses should distinguish between the existence of the law and the operational details of licensing.

What Virtual Asset Activities Are Covered?

The framework is broader than crypto exchange activity.

Depending on the exact business model, regulated activity can include services involving:

• Exchange.
• Transfer.
• Custody.
• Administration.
• Issuance.
• Listing.
• Other virtual asset services defined under the law.

The exact classification matters.

A centralized exchange is different from a software developer.

A custodian is different from a non-custodial technology provider.

An issuer can face different obligations from a broker.

What Is Not Automatically Covered?

The law's scope provisions exclude certain activities, including logistics and technical assistance, hardware manufacture and software engineering, and services provided to hardware wallet manufacturers.

The exclusion does not mean every technology company is free from all regulation.

The actual business model matters.

A company that develops software is not automatically a regulated VASP.

A company that also holds customer assets or executes regulated transactions may face a different result.

Can Foreign Crypto Companies Serve Rwanda?

Digital services can cross borders without a physical office.

The law applies to relevant virtual asset service providers and issuers operating in or from Rwanda.

A foreign business should assess:

• Whether it targets Rwandan customers.
• Whether it markets into Rwanda.
• Whether it has a local entity.
• Whether it holds customer assets.
• Whether it provides exchange or transfer services.
• Whether it issues tokens or stablecoins.
• Whether its activities connect with Rwanda's regulated market.

A global website is not automatically exempt from local law.

The analysis depends on the actual service and jurisdictional connection.

Stablecoin Regulation in Rwanda

Stablecoins receive specific attention under Rwanda's new framework.

That matters because stablecoins can be used for:

• Digital settlement.
• Transfers.
• Liquidity.
• Cross-border transactions.
• On-chain financial services.

The Official Gazette text specifically addresses stablecoins and reserve assets.

The law also excludes algorithm-based stablecoins from the virtual asset definition used for this framework.

Not every asset marketed as a stablecoin falls into the same regulatory category.

Why Stablecoin Issuers Face Additional Responsibilities

A stablecoin issuer can create wider risks.

The quality of the reserve matters.

Custody matters.

Redemption arrangements matter.

Disclosure matters.

The new framework therefore treats stablecoin issuance as a regulated activity.

A business should not assume that a price peg turns a token into an ordinary software product.

Tokenisation and Real-World Assets

Rwanda's framework also looks beyond cryptocurrency.

The law addresses tokenisation of real-world assets.

Tokenisation can connect blockchain infrastructure with traditional capital markets.

Potential examples can include:

• Financial assets.
• Investment interests.
• Other assets represented digitally.

The regulatory questions include investor rights, custody, disclosure and market integrity.

The CMA's annual report says the framework was developed with attention to international standards and risk-based regulation.

That approach is especially important for tokenised financial products.

Rwanda's Regulatory Sandbox

The law provides for a regulatory sandbox.

A sandbox can allow eligible innovative products and services to be tested in a controlled environment.

Testing is limited.

It takes place for a defined period.

The regulator provides oversight.

The Official Gazette text creates the legal basis for this approach.

A sandbox is not a blanket exemption.

Businesses should follow the applicable rules and entry requirements.

AML, CFT and Financial Crime Controls

Financial crime risk was one of the strongest reasons Rwanda developed a dedicated framework.

The CMA's 2024–2025 Annual Report says the framework was informed by the national risk assessment and international AML/CFT standards.

The report highlights risks involving:

• Money laundering.
• Terrorist financing.
• Consumer fraud.
• Market manipulation.
• Wider financial-sector vulnerabilities.

A serious virtual asset business should expect to consider controls such as:

• Customer due diligence.
• Customer risk assessment.
• Transaction monitoring.
• Sanctions screening.
• Suspicious activity escalation.
• Record keeping.
• Governance controls.
• Information security.

The exact obligations should be checked against the law, Rwanda's AML framework and implementing regulations.

Consumer and Investor Protection

The new framework is not only about licensing.

Consumer protection is a major objective.

During the Parliamentary discussion, lawmakers highlighted fraud and theft disguised as short-term investment opportunities and pyramid schemes.

Regulation can establish rules.

It cannot make every crypto investment safe.

Price Risk Remains

Bitcoin can be volatile.

Altcoins can be even more volatile.

Stablecoins can face de-pegging and reserve risks.

Fraud Risk Remains

Scammers can impersonate legitimate businesses.

They can promise guaranteed returns.

They can operate fake trading platforms.

Users should independently verify a company's status.

Custody Risk Remains

A regulated provider can reduce some risks.

It cannot eliminate all operational risk.

Self-custody creates a different risk.

A lost private key can result in permanent loss of access.

Penalties for Unlicensed Virtual Asset Business

The law includes criminal offences and penalties.

The Official Gazette text includes offences relating to unlicensed virtual asset business and other prohibited conduct.

The framework can include:

• Financial penalties.
• Imprisonment for relevant criminal offences.
• Administrative sanctions.
• Suspension or revocation of permissions.
• Orders to cease or restrict activities.

The exact penalty should always be checked against the current official law and implementing regulations.

Rwanda's Virtual Asset Market Before the 2026 Law

The 2026 law did not appear without preparation.

The CMA's 2024–2025 Annual Report says the CMA co-led a national risk assessment on virtual assets and VASPs with the National Bank of Rwanda.

The assessment found that the sector was small.

It also found that the market was growing rapidly.

The report said the lack of a regulatory framework increased vulnerability.

One key recommendation was a comprehensive framework.

The law followed.

Rwanda's Digital-Finance Base Is Already Large

According to Rwanda's FinScope 2024 Survey:

• 96% of adults were financially included.
• That represented about 7.8 million people.
• 92%, or about 7.5 million people, were formally served.
• 86%, or about 6.9 million adults, had used mobile money.
• 77%, or about 5.8 million adults, had a mobile wallet registered in their own name.
• Only 4%, or about 316,000 adults, were financially excluded.

These are not crypto adoption statistics.

They show that Rwanda already has deep experience with formal and digital finance.

Rwanda Crypto Regulation Timeline

2024–2025: Risk Assessment and Framework Development

The CMA's 2024–2025 Annual Report says Rwanda carried out a national risk assessment covering virtual assets and VASPs.

The sector was described as small but rapidly growing.

The assessment recommended a comprehensive regulatory framework.

31 March 2026: Parliamentary Review

The Chamber of Deputies approved the relevance of the draft law.

The proposed framework emphasized consumer protection, crime prevention, innovation and licensing.

25 May 2026: Law Dated

Law nº 023/2026 is dated 25 May 2026.

28 May 2026: Law Published

The Official Gazette published the law on 28 May 2026.

The CMA's laws page lists the Law Regulating Virtual Asset Business.

20 May 2026: Virtual Assets Awareness Session

The CMA held an awareness session for capital market players.

The CMA emphasized technical capacity, collaboration, market integrity, investor protection and financial stability.

What Does the New Law Mean for Crypto Exchanges?

A centralized exchange may perform several regulated functions.

These can include:

• Exchange.
• Custody.
• Transfer.
• Listing.
• Customer onboarding.

The business should assess its full operating model.

One licence question may not cover every activity.

A company should consider:

• Which services it provides.
• Which assets it supports.
• Whether it holds customer assets.
• Whether it serves Rwandan residents.
• Its corporate structure.
• Its AML programme.
• Its governance.
• Its cybersecurity controls.

A global exchange should not assume that one foreign authorization automatically satisfies Rwanda's requirements.

What Does the New Law Mean for Stablecoin Businesses?

The law specifically addresses stablecoin issuance and reserve assets.

That makes Rwanda's framework relevant to businesses building digital payment infrastructure.

The key issue is not simply whether a token is called a stablecoin.

The issuer matters.

The reserve structure matters.

Custody matters.

The regulatory status matters.

For a related African payments perspective, see Tanzania's cross-border payments market, where mobile money, regional systems and international transfers are already changing how value moves across borders.

Stablecoins could create additional settlement opportunities.

The regulatory model still matters.

Rwanda and Cross-Border Virtual Asset Services

Crypto is international.

A wallet can receive value from another country.

An exchange can connect customers across markets.

A stablecoin can move between addresses in seconds.

Regulation remains national.

That creates a cross-border compliance challenge.

A business may need to consider:

• Customer location.
• Licensing.
• AML obligations.
• Sanctions.
• Travel Rule requirements.
• Payment-system regulation.
• Foreign exchange rules.
• Data protection.
• Tax.

For comparison, Zambia cryptocurrency regulation also shows how African regulators are moving toward more formal VASP oversight.

The frameworks are different.

The focus on compliance, consumer protection and financial integrity is increasingly shared.

Rwanda Crypto Regulation Statistics

• Law nº 023/2026 — Rwanda's dedicated virtual asset business law.
• 25 May 2026 — date of the law.
• 28 May 2026 — Official Gazette publication date.
• 96% — financial inclusion in the 2024 FinScope survey.
• 7.8 million — financially included adults.
• 92% — adults formally served.
• 7.5 million — formally served adults.
• 86% — adults who had used mobile money.
• 6.9 million — adults who had used mobile money.
• 77% — adults with a mobile wallet registered in their own name.
• 5.8 million — adults with a registered mobile wallet.
• 4% — adults financially excluded.
• 316,000 — financially excluded adults.

These figures measure different parts of Rwanda's financial and regulatory environment.

They should not be combined into a crypto market size.

What Happens Next for Rwanda Crypto Regulation?

The biggest next step is implementation.

The primary law now exists.

The regulatory ecosystem must become operational.

That can involve implementing regulations, licensing processes, supervisory procedures and technical standards.

The CMA's May 2026 statement emphasized that implementation requires technical knowledge and coordination among institutions and market participants.

Companies interested in Rwanda should monitor:

• CMA implementing regulations.
• Licensing procedures.
• Capital and prudential requirements.
• Governance standards.
• Stablecoin rules.
• Token issuance requirements.
• Sandbox rules.
• AML/CFT requirements.
• Regulatory coordination with the National Bank of Rwanda.

The Bottom Line

Rwanda's cryptocurrency regulation changed fundamentally in 2026.

Law nº 023/2026 was published on 28 May 2026.

Rwanda now has a dedicated legal framework for virtual asset business.

The Capital Market Authority is the main regulatory authority.

Licensing is central to the new system.

The law also addresses stablecoins, tokenisation, consumer protection, market integrity, AML/CFT risks, enforcement and innovation.

The framework is being introduced into a highly connected financial environment.

Rwanda's 2024 FinScope survey recorded 96% financial inclusion and 86% mobile money usage among adults.

Those figures are not crypto adoption data.

They show Rwanda's deep experience with formal and digital finance.

For businesses, the message is simple.

Do not treat Rwanda as an unregulated crypto market.

The law is now in force.

The next phase is implementation.

Businesses should follow the CMA and other relevant authorities before launching or expanding a virtual asset service.