Zimbabwe Cryptocurrency Regulation: VASP Registration, AML Rules and the New 2026 Framework

Zimbabwe's cryptocurrency regulation changed materially in 2026.

The country now has a dedicated registration framework for virtual asset service providers under Statutory Instrument 99 of 2026. The Financial Intelligence Unit says the framework brings VASPs into registration and supervision for anti-money-laundering and counter-terrorist-financing purposes.

The shift is notable because the market had previously operated with limited formal regulatory infrastructure.

Zimbabwe's 2024 Virtual Assets and Virtual Asset Service Providers Risk Assessment described the sector as nascent, with limited penetration, informal trading and underdeveloped infrastructure.

The same assessment found an overall ML/TF/PF risk rating of Medium Low.

The market was still visible internationally. Chainalysis ranked Zimbabwe 100th globally in its 2025 Global Crypto Adoption Index, with Zimbabwe ranking 86th for retail centralized-service activity.

The regulatory story is therefore no longer simply about whether Zimbabwe regulates crypto.

The more useful question is what the new registration system actually does.

Zimbabwe Cryptocurrency Regulation at a Glance

• 10 June 2026 — date Statutory Instrument 99 of 2026 was gazetted.

• US$500 — registration fee reported under S.I. 99 of 2026.

• US$400 — annual renewal fee reported under the 2026 framework.

• 100,000 USD — maximum fine provided in section 3A of the amended Money Laundering and Proceeds of Crime Act for carrying on VASP business in contravention of the registration requirements.

• 2 years — maximum imprisonment term provided in the same provision.

• 30 April 2026 — end of the transition period for persons who were lawfully carrying on VASP business before commencement of the Finance Act 2025 amendments.

• 100% of client liabilities — no, this figure belongs to another jurisdiction and should not be used for Zimbabwe.

• 100 — Zimbabwe's overall ranking in the 2025 Chainalysis Global Crypto Adoption Index.

• 86 — Zimbabwe's retail centralized-service ranking in the same index.

• 105 — Zimbabwe's 2024 ranking under the previous Chainalysis index.

The fee and penalty figures describe the registration and enforcement framework.

They do not represent the total cost of becoming operationally compliant.

What Is S.I. 99 of 2026?

S.I. 99 of 2026 is titled the Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026.

It was gazetted on 10 June 2026.

The regulations were made under the Money Laundering and Proceeds of Crime Act after the Finance Act No. 7 of 2025 amended that law to bring virtual assets and VASPs into the financial-institution framework.

The Financial Intelligence Unit's public notice explains the purpose in practical terms.

VASPs must register with the FIU and comply with AML/CFT obligations.

The framework covers businesses involved in exchange, transfer and custody-related virtual-asset services.

Registration Is Not the Same as a Licence to Operate

This distinction is critical.

The FIU's 16 June 2026 public notice explicitly says FIU registration for AML/CFT purposes does not, by itself, constitute authorisation to carry on business in Zimbabwe.

A registered VASP may still need approvals, licences or authorisations from other competent authorities depending on the activities it performs.

The notice specifically points to the Reserve Bank of Zimbabwe and the Securities and Exchange Commission of Zimbabwe where applicable.

So Zimbabwe has introduced a registration framework.

It has not created a single registration certificate that automatically authorises every crypto-related financial activity.

How Zimbabwe's 2025 Legal Changes Created the Framework

The regulatory change started with the Finance Act No. 7 of 2025.

The 2025 Act amended the Money Laundering and Proceeds of Crime Act to introduce the definitions of “virtual asset” and “virtual asset service provider” and to bring specified virtual-asset services into the definition of “financial institution.”

The amendments were made through section 68 of the Finance Act No. 7 of 2025.

The same amendment inserted section 3A into the Money Laundering and Proceeds of Crime Act.

Section 3A requires a person carrying on the business of a VASP in or from Zimbabwe to be registered with the Financial Intelligence Unit and to comply with any other registration or licensing requirements applicable under other laws.

The next step came with the Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (S.I. 99 of 2026).

The regulations were gazetted on 10 June 2026.

They were made by the Minister of Finance, Economic Development and Investment Promotion under section 103 read with section 3A(1)(a) of the Money Laundering and Proceeds of Crime Act.

The sequence matters.

The 2025 legislation created the statutory basis for regulating VASPs under the AML framework.

The 2026 regulations then provided the registration framework required by section 3A.

The Financial Intelligence Unit now provides the VASP registration process and related compliance resources.

Registration with the FIU should not be confused with every other licence or approval that a crypto business may require under Zimbabwean law.

Zimbabwe's 2024 Risk Assessment Provides Important Context

Zimbabwe's first dedicated virtual-asset national risk assessment covered the period from 2019 to 2024.

The Financial Intelligence Unit's assessment found a virtual-asset market with limited VASP activity.

It rated the overall ML/TF/PF risk as Medium Low.

The report attributed that rating partly to the sector's nascent stage, limited product adoption and minimal interaction between VASPs, virtual-asset transactions and the traditional financial sector.

The same assessment warned that the potential for abuse could become significant in the absence of a regulatory framework and given the prevalence of P2P transactions.

What Did the Risk Assessment Find About Crypto Businesses?

The assessment identified four primary categories of VASP activity operating in Zimbabwe:

• Wallet providers.

• Exchanges.

• Initial coin offerings.

• Information providers.

The risk assessment also found that six cryptocurrency exchanges had originated from Zimbabwe since 2018.

Most had ceased operations around 2020, leaving two still operating at the time of the study.

At their peak, none of those Zimbabwe-originated exchanges had more than 3,000 subscribers.

The assessment also found that most VASPs surveyed served fewer than 1,000 customers, while four entities had customer bases ranging from 10,000 to 100,000, primarily operating outside Zimbabwe while serving Zimbabweans.

Those numbers are historical.

They describe the market captured by the 2019–2024 assessment rather than the number of VASPs currently registered in 2026.

Zimbabwe's Crypto Market Is Closely Linked to P2P Activity

P2P trading is one reason the market can remain active even when formal infrastructure is limited.

The risk assessment identified P2P transactions as an important part of the ecosystem.

It also assessed P2P exchange services as presenting Medium risk at the residual-risk level in its detailed risk matrix.

The FATF's latest 2026 virtual-asset update highlights P2P transactions through unhosted wallets as an increasing area of illicit-finance concern globally.

That does not mean every P2P trade is illicit.

It means regulators increasingly focus on the risks that arise when value moves outside intermediated financial institutions.

Zimbabwe's Registration Fee Is Relatively Small

The new framework reports a US$500 registration fee and a US$400 annual renewal fee.

The fee itself is unlikely to be the biggest barrier for a serious crypto company.

The more substantial obligations relate to governance, AML/CFT controls, local presence, compliance personnel, documentation and continuing supervision.

The registration fee is therefore better viewed as an administrative charge rather than the cost of regulatory compliance as a whole.

What Does the Application Require?

The 2026 framework requires more than a payment and a form.

Current legal analysis of S.I. 99 identifies requirements around corporate documentation, beneficial ownership, directors, compliance arrangements and the applicant's physical business presence.

The Fidelity Intelligence Unit VASP portal publishes the VASPR application form and related regulatory resources.

The framework is designed to give the regulator enough information to understand who controls the business, how it operates and what risks it creates.

Local Presence Matters

Zimbabwe's new framework is not simply an offshore registration exercise.

The application requirements include a local physical business presence.

Current legal analysis of S.I. 99 also identifies a requirement for at least two directors resident in Zimbabwe and a resident money-laundering compliance officer.

Those details matter for international operators.

A company cannot assume that a foreign crypto platform can simply register a Zimbabwean entity without building local governance and compliance capacity.

AML/CFT Is at the Centre of the Regime

Zimbabwe is using the AML framework as the immediate regulatory foundation for VASPs.

The FIU's VASP notice says the framework is intended to ensure that VASPs implement adequate measures to detect and prevent the misuse of virtual assets for money laundering, terrorist financing and related financial crimes.

That aligns with the FATF's global virtual-asset standards, which call on countries to licence or register VASPs and subject them to effective supervision.

The Zimbabwean model therefore fits into a broader international regulatory direction.

Customer Due Diligence and Record Keeping

VASPs are expected to apply customer due-diligence measures.

That means identifying customers.

It also means understanding beneficial ownership where relevant and monitoring transactions for unusual activity.

Records need to be maintained.

Suspicious transactions need to be reported through the applicable AML framework.

These obligations are not optional because a business calls itself a technology company.

The relevant question is whether the business performs a regulated virtual-asset service.

The Travel Rule and Information Requirements

The Travel Rule is now a central part of international virtual-asset regulation.

The FATF's 2026 targeted update says 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule.

Zimbabwe's new VASP framework is being developed against that international backdrop.

VASPs should therefore expect increasing emphasis on collecting and transmitting information about the originator and beneficiary of qualifying transfers.

The exact operational implementation needs to be assessed against Zimbabwe's current rules and any guidance issued by the FIU.

What Happens If a VASP Does Not Register?

The amended Money Laundering and Proceeds of Crime Act makes unregistered VASP activity an offence.

Section 3A provides for a fine of up to US$100,000, imprisonment for up to two years, or both.

That is a significant escalation from the pre-2026 environment.

The law therefore does more than ask businesses to notify the authorities.

It attaches criminal consequences to operating outside the registration requirement.

Zimbabwe's Transition Period Has Already Ended

The amended law provided a temporary transition for persons who were lawfully conducting VASP business before the Finance Act 2025 amendments.

That transition ended on 30 April 2026.

After that date, captured businesses could no longer rely on the temporary continuation provision.

The 2026 registration system is therefore now the relevant framework for businesses falling within the VASP definition.

The Financial Intelligence Unit's Role

The FIU is at the centre of the new AML registration framework.

The FIU's VASP portal provides registration forms, legal materials, risk indicators and Travel Rule guidance.

The FIU also supervises VASPs for AML/CFT purposes.

That does not turn the FIU into the sole regulator of every possible crypto business activity.

The activity may still trigger oversight from other authorities.

The Reserve Bank of Zimbabwe Also Matters

The Reserve Bank remains relevant because virtual assets can interact with payments, foreign exchange and the banking system.

The FIU's public notice makes clear that registration does not replace any required approval from the Reserve Bank where another law requires it.

The RBZ fintech regulatory sandbox is another part of Zimbabwe's innovation infrastructure.

It allows financial-technology products to undergo monitored testing under the relevant financial laws.

A sandbox should not be confused with VASP registration.

The Securities and Exchange Commission Has a Role Too

The Securities and Exchange Commission of Zimbabwe can become relevant when a digital asset or service falls within the securities framework.

The FIU's June 2026 public notice expressly identifies SECZim among the authorities whose approvals may still be required depending on the activity.

For businesses developing tokenized investment products, marketplaces or other capital-market services, the securities perimeter therefore needs to be assessed separately.

Zimbabwe's Earlier Approach to Cryptocurrency

Before the current framework, the Reserve Bank had taken a cautious position.

The RBZ's virtual-currency statement warned that virtual currencies were not regulated, not issued by public authorities and did not have legal-tender status.

Financial institutions were also warned about their involvement with cryptocurrency activity.

That approach contributed to a market that developed largely outside conventional banking channels.

The New Framework Does Not Mean Zimbabwe Has Become a Crypto Free-for-All

That is an important distinction.

The 2026 regulations bring VASPs into an AML registration framework.

They do not remove all other financial laws.

They do not make every crypto activity automatically permissible.

They do not turn FIU registration into a universal operating licence.

The FIU itself warns the public that virtual assets remain high-risk products.

That warning includes price volatility, loss of funds, fraud, scams, cyber risks and cross-border enforcement challenges.

Zimbabwe's Crypto Market and Pan-African Regulation

Zimbabwe is moving at the same time as several other African markets.

Mauritius has a dedicated VASP licensing regime. See Mauritius cryptocurrency regulation.

Seychelles also operates a dedicated VASP framework. See Seychelles cryptocurrency regulation.

Rwanda introduced its own virtual-asset framework in 2026. See Rwanda cryptocurrency regulation.

Zimbabwe's model is different.

It begins with AML registration and leaves other activity-specific authorisations in place.

A Personal Interest in Zimbabwe's Legal Space

I have always been interested in Zimbabwe because of its strong Pan-African tradition.

That interest made me pay closer attention to the country's legal and financial institutions.

Zimbabwe has also faced unusual monetary and financial pressures over the years.

That made its approach to emerging financial technology particularly interesting to me.

When I began looking at the country's cryptocurrency rules, I wanted to understand one thing.

Would Zimbabwe eventually build a formal framework around a market that had already developed informally?

The answer arrived in 2026.

The country now has a statutory registration framework for VASPs.

What Should Crypto Businesses Do Now?

The first step is to map the business model.

A company should identify whether it provides exchange, transfer, custody, wallet or another virtual-asset service.

It should then identify every additional regulated activity.

The second step is to establish the required local structure.

That includes governance, compliance and operational substance.

The third step is to build the AML/CFT programme before applying.

The fourth step is to assess whether the business needs separate approvals from the RBZ, SECZim or another authority.

Registration is not the end of the regulatory process.

It is the beginning of supervised operation.

What Could Change Next?

The biggest open question is how Zimbabwe will develop the broader regulatory architecture around virtual assets.

The 2026 registration framework is focused heavily on AML/CFT.

Future rules could clarify licensing, consumer protection, prudential requirements, market conduct, custody and other areas.

The direction will also be influenced by international standards.

The FATF's July 2026 update calls for stronger implementation, supervision and enforcement across virtual-asset markets.

Zimbabwe's next regulatory steps will therefore matter beyond the registration certificate itself.

Zimbabwe Cryptocurrency Regulation: Key Numbers and Dates

• 10 June 2026 — S.I. 99 of 2026 gazetted.

• 16 June 2026 — FIU public notice explaining the VASP registration framework.

• US$500 — reported VASP registration fee.

• US$400 — reported annual renewal fee.

• US$100,000 — maximum fine for operating VASP business in breach of section 3A.

• 2 years — maximum imprisonment under section 3A.

• 30 April 2026 — end of the statutory transition period.

• 100th — Zimbabwe's 2025 Chainalysis global adoption ranking.

• 86th — Zimbabwe's 2025 retail centralized-service ranking.

• 105th — Zimbabwe's 2024 Chainalysis ranking.

• 3,000 — maximum subscribers reported for the Zimbabwe-originated exchanges studied in the 2024 risk assessment.

• 10,000 to 100,000 — customer-base range reported for four VASPs serving Zimbabweans, primarily from outside Zimbabwe.

Frequently Asked Questions

Is cryptocurrency legal in Zimbabwe?

Zimbabwe now has a formal AML registration framework for VASPs. Registration is required for captured VASP activity, but FIU registration by itself does not authorise every crypto-related financial activity.

Does Zimbabwe have a VASP licence?

Zimbabwe has introduced VASP registration under S.I. 99 of 2026. The FIU has specifically stated that registration for AML/CFT purposes is not, by itself, a licence or authorisation to conduct every type of crypto business.

How much does VASP registration cost in Zimbabwe?

Current legal commentary on S.I. 99 of 2026 reports a US$500 registration fee and a US$400 annual renewal fee.

Who regulates cryptocurrency businesses in Zimbabwe?

The Financial Intelligence Unit administers the AML/CFT VASP registration framework. The Reserve Bank of Zimbabwe, Securities and Exchange Commission of Zimbabwe and other authorities may also be relevant depending on the business activity.

What happens if a crypto business operates without registration?

Section 3A of the amended Money Laundering and Proceeds of Crime Act provides for a fine of up to US$100,000, imprisonment of up to two years, or both for qualifying unregistered VASP activity.

The Bottom Line

Zimbabwe has moved from a largely informal cryptocurrency market toward a formal AML registration framework.

The change came in 2026.

S.I. 99 of 2026 created the registration mechanism.

The FIU now has a dedicated VASP portal and registration process.

But one distinction must remain clear.

Registration is not automatically a licence to conduct every crypto-related business activity.

The FIU itself says additional approvals may still be required.

That makes Zimbabwe's framework more nuanced than the simple headline that "Zimbabwe has regulated crypto."

The market was already developing before the new rules.

The 2024 national risk assessment found a limited but real virtual-asset ecosystem, including exchanges, wallets, P2P activity and other services.

Chainalysis also ranked Zimbabwe 100th globally in its 2025 adoption index.

The next stage will be about implementation.

Businesses will need to move from informal structures to documented governance, AML/CFT controls and regulatory engagement.

Zimbabwe has opened the door to formal oversight.

What comes next will determine how wide that door becomes.