Kigali, June 29, 2026 — Rwanda has enacted Law No. 023/2026 of 25/05/2026 Regulating Virtual Asset Business, making it the only East African Community member state with parliament-passed, formally gazetted cryptocurrency legislation. The law entered into force on May 28, though it is not yet fully operational pending the publication of secondary regulations, following a unanimous parliamentary vote on May 5. The Capital Market Authority of Rwanda (CMA) will serve as the primary licensing body, with the National Bank of Rwanda (BNR) retaining jurisdiction over payment systems and monetary policy where virtual assets intersect with both.

---

From Warning to Law

The shift is significant. Since 2018, Rwanda's central bank had effectively barred licensed financial institutions from converting Rwandan francs into crypto, with its official guidance warning that anyone trading digital currencies did so "at their own risk." That position held for nearly eight years.

The April 2026 Bybit incident made the gap between policy and reality impossible to ignore. Just weeks before the law passed, the BNR issued a public warning after the global exchange enabled peer-to-peer franc-to-crypto trading on its platform. Rwanda moved to block the feature. The episode was a visible signal. According to parliamentary testimony by MP Theogene Munyangeyo, Chairperson of the Parliamentary Committee on Economy and Trade, citing Statista data, roughly 350,000 Rwandans were already using virtual assets. Many of them were doing so through unprotected P2P channels, primarily on platforms including Binance and OKX, with no consumer protection in place.

Jean Pierre Bucyenyisenge, CEO of PFXM, put it plainly: "Without clear rules, users have faced scams, uncertainty and lack of protection." He added that formal regulation could "strengthen financial inclusion and lower cross-border transaction costs" for ordinary Rwandans.

---

How the Regulatory Architecture Works

The law divides oversight deliberately. The CMA licenses exchanges, custodians, brokers, token issuers, settlement platforms, and real-world asset (RWA) tokenization operators. RWA tokenization refers to representing physical assets such as property or commodities as tradeable digital tokens on a blockchain. The BNR handles anything touching payment systems or monetary stability, including stablecoin use for actual transactions. The Financial Intelligence Centre enforces anti-money-laundering, counter-terrorism financing, and counter-proliferation financing rules.

Virtual assets are explicitly not legal tender under the new framework. Using them for payments requires separate BNR authorization. Among the activities prohibited without specific approval are mining operations, virtual asset ATMs, mixer services (tools that obscure transaction trails), using virtual assets as payment without authorization, and marketing unlicensed virtual asset services.

The law carries a substantial penalty regime. Fines range from FRW 20 million (approximately USD 13,600) for marketing unlicensed virtual asset services to FRW 150 million (approximately USD 102,000) for unauthorized issuance of virtual assets. Certain offences also carry imprisonment terms of up to five years. The breadth of the penalty schedule reflects the law's intent to create enforceable boundaries from the outset, well before the secondary regulations that will govern licensing are finalized.

Only incorporated legal entities may apply for licenses. Individual operators are barred from offering virtual asset services.

Jerome Ndayambaje, a digital innovation analyst at the CMA, said the authority "engaged extensively with industry players" during the drafting process.

---

The Payments Thesis

Emmanuel Muragijimana, Partner at K-Solutions and Partners, and Tamara Munya Buranga, Associate at the same firm, writing in the New Times, argue the law's most immediate commercial impact will be on payment infrastructure rather than speculative trading. By permitting licensed reserve-backed stablecoins (digital tokens pegged to fiat currency and backed by actual reserves) for clearing and settlement, the framework opens the door to compressing multi-day settlement windows down to minutes, including across weekends and public holidays.

Rwanda joins Singapore, Hong Kong, Japan, and the European Union in building a legal foundation for this kind of stablecoin infrastructure, against a global stablecoin market that now exceeds $320 billion in total value.

Rwanda's estimated crypto revenue grew from $1.3 million in 2024 to $3.1 million in 2025, according to Statista, with user penetration at roughly 2.25 percent of the population. Those numbers are modest compared to Kenya's estimated 4 million users, Uganda's 2 million, and Tanzania's 1.5 million, but analysts argue the legal framework now in place gives Rwanda a structural distinction its neighbors currently lack.

---

The Readiness Gap

Businesses should not expect to obtain licenses immediately. Secondary regulations covering licensing procedures, minimum capital requirements, liquidity ratios, and reporting standards are still being drafted. Until those rules are published, the licensing process cannot formally begin.

A joint CMA and BNR regulatory sandbox does allow companies to test products outside the law's full scope in a controlled environment. That is the practical entry point for early movers while the secondary rules take shape.

The law also leaves several categories unregulated for now: algorithmic stablecoins, privacy-focused cryptocurrencies, NFTs, central bank digital currencies (CBDCs), closed-loop tokens such as gaming rewards, instruments already covered under existing capital markets law, and decentralized protocols without identifiable operators. That last exclusion is particularly relevant for developers building in the decentralized finance space, as it places them outside the new framework's licensing perimeter entirely.

---

East Africa's Regulatory Cascade

Rwanda's move is part of a broader regional pattern. Kenya passed its own Virtual Asset Service Provider Act in 2025, splitting oversight between its Capital Markets Authority and Central Bank. Uganda and Tanzania have rising adoption figures but no comprehensive legislation yet. Nigeria recognized digital assets as securities under its Investments and Securities Act 2025; separately, the Central Bank of Nigeria relaxed restrictions on banks working with licensed virtual asset service providers. South Africa had approved 310 VASP licenses from 533 applications as of March 2026.

Rwanda is now positioned to compete as a regional fintech hub. The country already counts more than 100 fintech companies operating locally, has achieved over 90 percent financial inclusion, and launched the Rwanda FinTech Centre in March 2026 through a coalition comprising the Ministry of ICT and Innovation, the Kigali International Financial Centre (KIFC), the ICT Chamber, the Rwanda Fintech Association, and Luxembourg Cooperation. Its National Fintech Strategy targets $200 million in fintech investment and 80 percent adoption of fintech solutions by 2029.

The law is in force. Whether it delivers on its promise depends on how quickly and how well the secondary regulations are written.