Rwanda Crypto & Digital Asset Regulation

Token Classification

Law N 023/2026 draws its own scope boundaries by express statutory exclusion rather than by a positive classification test. Algorithmic stablecoins, privacy-focused cryptocurrencies, non-fungible tokens, central bank digital currencies, capital-markets-regulated securities and closed-loop-system assets are all carved out of the statute's ambit. This exclusion list is sourced to the enabling law itself, though the precise pinpoint provision remains unconfirmed against primary Gazette text, which keeps the finding at a probable rather than confirmed tier.

The practical effect of a scope defined by exclusion is that anything not expressly carved out falls, by implication, within the statute's reach and therefore within the Capital Market Authority's licensing perimeter. This is a meaningfully different drafting approach from a jurisdiction that defines virtual assets positively and then exempts specific categories, and it means the boundary cases — tokenised real-world assets, for instance, or hybrid instruments that sit near the securities exclusion — do not yet have a confirmed classification test available in the sourced material. No implementing regulation addressing how borderline tokens should be classified against these exclusions has been identified.

The exclusions themselves are reasonably clear as drafted, which is why this module sits at amber rather than red: the boundary of what is excluded is known, even though the test for classifying assets that fall inside the remaining scope is not yet published.

Outlook

As the Capital Market Authority's implementing regulations develop, classification tests for assets near the statutory exclusion boundaries — particularly tokenised real-world assets and hybrid stablecoin-adjacent instruments tested through the joint regulatory sandbox — are the area most likely to generate interpretive detail. Until such guidance appears, market participants operating near these boundaries face continued classification uncertainty.

Token Classification

Rwanda's virtual-asset law approaches token classification principally through exclusion rather than through a positively defined taxonomy. Two carve-outs are evidenced. First, non-fungible tokens are expressly excluded from the statute's definition of "virtual asset," meaning NFT activity in Rwanda sits outside the scope of the CMA's virtual-asset licensing and supervisory regime entirely, at least as that regime is currently constituted. Second, within the category of fiat-referenced tokens, a distinction is drawn between stablecoins that meet full-reserve, CMA-approved, custodian-held criteria — which are treated as regulated stablecoins — and algorithmic stablecoins, which are excluded from that regulated-stablecoin treatment.

This carve-out structure has a practical implication for any entity seeking to classify a specific token under Rwandan law: the relevant question is not which affirmative category the token fits, but which exclusion applies to it, if any. A token that does not fall within an express carve-out presumably falls within the general virtual-asset definition and its associated licensing and compliance obligations, though the general definition itself was not independently retrieved from the primary gazetted text.

The classification approach corresponds to the broader structure of Law No. 023/2026, under which the CMA is positioned as the body responsible for determining how specific instruments are treated, including through its approval function over stablecoin issuance and its supervisory role over tokenisation of real-world assets. No classification detail specific to security-type tokens, utility tokens, or governance tokens was located.

Outlook

The pending CMA secondary regulations, expected around the first quarter of 2027, are the most likely vehicle for further elaboration of the classification taxonomy, including any additional carve-outs or sub-categories within the virtual-asset definition. Until then, classification questions for novel token types in Rwanda default to the exclusion-based framework set out in the primary law.

Token Classification

Rwanda's virtual-asset law approaches token classification principally through exclusion rather than through a positively defined taxonomy. Two carve-outs are evidenced this cycle. First, non-fungible tokens are expressly excluded from the statute's definition of "virtual asset," meaning NFT activity in Rwanda sits outside the scope of the CMA's virtual-asset licensing and supervisory regime entirely, at least as that regime is currently constituted. Second, within the category of fiat-referenced tokens, a distinction is drawn between stablecoins that meet full-reserve, CMA-approved, custodian-held criteria — which are treated as regulated stablecoins — and algorithmic stablecoins, which are excluded from that regulated-stablecoin treatment.

This carve-out structure has a practical implication for any entity seeking to classify a specific token under Rwandan law: the relevant question is not which affirmative category the token fits, but which exclusion applies to it, if any. A token that does not fall within an express carve-out presumably falls within the general virtual-asset definition and its associated licensing and compliance obligations, though the general definition itself was not independently retrieved from the primary gazetted text this cycle.

The classification approach corresponds to the broader structure of Law No. 023/2026, under which the CMA is positioned as the body responsible for determining how specific instruments are treated, including through its approval function over stablecoin issuance and its supervisory role over tokenisation of real-world assets. No classification detail specific to security-type tokens, utility tokens, or governance tokens was located this cycle.

Outlook

The pending CMA secondary regulations, expected around the first quarter of 2027, are the most likely vehicle for further elaboration of the classification taxonomy, including any additional carve-outs or sub-categories within the virtual-asset definition. Until then, classification questions for novel token types in Rwanda default to the exclusion-based framework set out in the primary law.

Token Classification

Law N° 023/2026 defines its own scope substantially through exclusion. Algorithmic stablecoins, privacy-focused cryptocurrencies, non-fungible tokens, central bank digital currencies, securities already regulated under capital markets legislation, and virtual assets used within closed-loop systems are all explicitly carved out of the statute's coverage. What remains within scope, by implication, is the broader category of virtual assets not otherwise excluded, including the stablecoins that do not qualify for the algorithmic exclusion.

For those in-scope stablecoins, the statute additionally requires that issuers obtain CMA approval and maintain full reserve backing at all times, independently verified, audited, and held by licensed custodians, a requirement that sits at the boundary between token classification and the dedicated stablecoin-regime module. Beyond these carve-outs and the stablecoin-specific reserve rule, no further granular sub-classification guidance has yet been published.

Outlook

Watch for CMA guidance that further sub-classifies the in-scope category beyond the current exclusion-based definition, particularly as the first licence applications, once implementing regulations are published, begin to test the boundaries of the statute's scope.

On-Chain Activity Regime

Law N 023/2026 prohibits cryptocurrency mining and mixer or tumbler services outright. This finding currently rests on a single lower-tier secondary source, and the precise statutory provision has not been confirmed against primary text, which holds the finding at an uncertain confidence tier rather than a higher one. The prohibition nonetheless represents the clearest on-chain restriction identified in Rwanda's virtual-asset framework to date: two specific categories of on-chain activity are named and barred, rather than left to a general licensing or registration requirement.

Beyond these two named prohibitions, no rule has been identified governing other categories of on-chain activity, such as staking, decentralised-exchange operation, or self-custody wallet provision. This leaves a substantial portion of the on-chain activity landscape without a sourced rule in either direction, which is the reason this module carries a red rather than amber posture: the regime is clear and restrictive on the narrow slice it addresses, but silent on the much larger remainder.

The prohibition on mixer and tumbler services, if it is confirmed by further sourcing, would align Rwanda with a broader regional and international trend of specifically targeting obfuscation-focused services as a category distinct from on-chain activity generally, reflecting an anti-money-laundering rationale for the restriction rather than a general hostility to on-chain activity as such.

Outlook

Further corroboration of the mining and mixer prohibitions against primary statutory text would raise the confidence tier on this finding. Whether the Capital Market Authority's anticipated implementing regulations will extend coverage to the currently unaddressed categories of on-chain activity, such as staking or decentralised-exchange operation, is not yet established in the sourced material and remains an open question for the module.

On-Chain Activity Regime

Rwanda's treatment of on-chain activity under Law No. 023/2026 is, at this stage, narrowly addressed rather than comprehensive. Two specific activities are explicitly covered. Cryptocurrency mining operations are prohibited unless expressly approved by the Capital Market Authority, placing mining under a default-prohibition regime rather than a permissive or unaddressed one. Separately, the CMA approves and supervises tokenisation of real-world assets as a defined regulatory function, indicating that real-world-asset tokenisation is treated as a distinct, CMA-governed activity category rather than being left to fall under general virtual-asset licensing alone.

Beyond these two activities, the on-chain activity regime is substantially undeveloped in the available sourcing. No provision addressing staking, decentralised-finance lending, decentralised exchanges, or validator-node operation under Rwandan law was located, despite active search. This is treated as a genuine research gap rather than a confirmed absence of regulation: it reflects a structurally thin area of sourcing for an emerging-market jurisdiction's on-chain activity framework, not necessarily an absence of any rule governing these activities under the broader statute or forthcoming secondary regulation.

The combination of an explicit mining prohibition-absent-approval and an explicit tokenisation-supervision function, against a backdrop of unaddressed DeFi and staking treatment, suggests the law was drafted with particular attention to two specific activity types rather than as an exhaustive on-chain activity code. Where it is silent, the general virtual-asset licensing and consumer-protection provisions of the statute would presumably apply by default, though this inference is not independently confirmed against primary text.

Outlook

Whether the CMA's forthcoming secondary regulations will extend specific treatment to staking, DeFi and validator activity is not yet known. Market participants engaging in on-chain activity beyond mining and real-world-asset tokenisation should treat the absence of specific rules as an open question rather than as settled permissiveness, pending further primary-source retrieval or the CMA's secondary rulemaking.

On-Chain Activity Regime

Rwanda's treatment of on-chain activity under Law No. 023/2026 is, at this stage, narrowly addressed rather than comprehensive. Two specific activities are explicitly covered. Cryptocurrency mining operations are prohibited unless expressly approved by the Capital Market Authority, placing mining under a default-prohibition regime rather than a permissive or unaddressed one. Separately, the CMA approves and supervises tokenisation of real-world assets as a defined regulatory function, indicating that real-world-asset tokenisation is treated as a distinct, CMA-governed activity category rather than being left to fall under general virtual-asset licensing alone.

Beyond these two activities, the on-chain activity regime is substantially undeveloped in the available sourcing. No provision addressing staking, decentralised-finance lending, decentralised exchanges, or validator-node operation under Rwandan law was located this cycle, despite active search. This is treated as a genuine research gap rather than a confirmed absence of regulation: it reflects a structurally thin area of sourcing for an emerging-market jurisdiction's on-chain activity framework, not necessarily an absence of any rule governing these activities under the broader statute or forthcoming secondary regulation.

The combination of an explicit mining prohibition-absent-approval and an explicit tokenisation-supervision function, against a backdrop of unaddressed DeFi and staking treatment, suggests the law was drafted with particular attention to two specific activity types rather than as an exhaustive on-chain activity code. Where it is silent, the general virtual-asset licensing and consumer-protection provisions of the statute would presumably apply by default, though this inference is not independently confirmed against primary text.

Outlook

Whether the CMA's forthcoming secondary regulations will extend specific treatment to staking, DeFi and validator activity is not yet known. Market participants engaging in on-chain activity beyond mining and real-world-asset tokenisation should treat the absence of specific rules as an open question rather than as settled permissiveness, pending further primary-source retrieval or the CMA's secondary rulemaking.

On-Chain Activity Regime

Law N° 023/2026 addresses on-chain activity narrowly. Cryptocurrency mining operations, virtual-asset automated teller machines, and mixer or tumbler services are each prohibited unless expressly approved by the Capital Market Authority. This is the full extent of the statute's explicit treatment of on-chain activity categories: staking, decentralised finance protocols, decentralised exchange operation, and node operation are none of them addressed in the sourcing reviewed this cycle, leaving their regulatory status genuinely undefined rather than merely under-detailed.

This is a materially incomplete regime by comparison with jurisdictions that have addressed a fuller range of on-chain activity categories, and it is flagged here as thin signal: the sourcing available supports only the mining-and-obfuscation-services prohibition, not a broader on-chain activity framework.

Outlook

Whether implementing regulations expected in the fourth quarter of 2026 extend beyond licensing mechanics to address staking, DeFi, or DEX activity is the key open question for this module; nothing in the sourcing reviewed this cycle indicates that they will.

Stablecoin Regime

Rwanda's stablecoin regime under Law No. 023/2026 is built on an authorisation-plus-reserve model. Stablecoin issuers must obtain Capital Market Authority approval before issuing a fiat-referenced token, and reserves backing any issued stablecoin must be maintained in full at all times and be independently verified and audited by a licensed custodian. This combination — prior approval and continuous full-reserve verification — places Rwanda's stablecoin framework in line with reserve-backing principles seen in more developed regimes, albeit set out at the level of primary law rather than through a detailed prudential rulebook.

The classification carve-out that excludes algorithmic stablecoins from this regulated-stablecoin treatment means the full-reserve and custodian-audit requirements apply specifically to fiat-referenced, full-reserve instruments, not to algorithmic designs; the regulatory status of an algorithmic stablecoin issued into or targeting the Rwandan market is accordingly less clear and was not resolved by any source reviewed.

A joint regulatory sandbox, managed by the CMA together with the National Bank of Rwanda, permits controlled testing of novel virtual-asset products, including presumably novel stablecoin designs, with a stated pathway from successful sandbox completion to a full licence. This sandbox mechanism offers a route for market entry that does not require immediate compliance with the full licensing framework, which is otherwise not yet operational pending secondary regulation. The minimum capital figure applicable to stablecoin issuers has not been located in any source and is understood to be a matter left to the CMA's pending secondary regulation.

Outlook

The detailed prudential rulebook for stablecoin issuance — including minimum capital, operational-risk requirements and the mechanics of custodian audit — remains pending CMA secondary regulation, expected around the first quarter of 2027. Until then, the full-reserve and prior-approval principles set in primary law are the operative standard, with the joint CMA/BNR sandbox offering the only confirmed near-term route to market testing.

Stablecoin Regime

Rwanda's stablecoin regime under Law No. 023/2026 is built on an authorisation-plus-reserve model. Stablecoin issuers must obtain Capital Market Authority approval before issuing a fiat-referenced token, and reserves backing any issued stablecoin must be maintained in full at all times and be independently verified and audited by a licensed custodian. This combination — prior approval and continuous full-reserve verification — places Rwanda's stablecoin framework in line with reserve-backing principles seen in more developed regimes, albeit set out at the level of primary law rather than through a detailed prudential rulebook.

The classification carve-out that excludes algorithmic stablecoins from this regulated-stablecoin treatment means the full-reserve and custodian-audit requirements apply specifically to fiat-referenced, full-reserve instruments, not to algorithmic designs; the regulatory status of an algorithmic stablecoin issued into or targeting the Rwandan market is accordingly less clear and was not resolved by any source reviewed this cycle.

A joint regulatory sandbox, managed by the CMA together with the National Bank of Rwanda, permits controlled testing of novel virtual-asset products, including presumably novel stablecoin designs, with a stated pathway from successful sandbox completion to a full licence. This sandbox mechanism offers a route for market entry that does not require immediate compliance with the full licensing framework, which is otherwise not yet operational pending secondary regulation. The minimum capital figure applicable to stablecoin issuers has not been located in any source this cycle and is understood to be a matter left to the CMA's pending secondary regulation.

Outlook

The detailed prudential rulebook for stablecoin issuance — including minimum capital, operational-risk requirements and the mechanics of custodian audit — remains pending CMA secondary regulation, expected around the first quarter of 2027. Until then, the full-reserve and prior-approval principles set in primary law are the operative standard, with the joint CMA/BNR sandbox offering the only confirmed near-term route to market testing.

Stablecoin Regime

Stablecoin issuance in Rwanda requires approval from the Capital Market Authority, with coordination from the National Bank of Rwanda given the payment-system and financial-stability implications of stablecoin activity. Issuers must maintain full reserve backing at all times, independently verified and audited, and held by licensed custodians. This dual-regulator coordination model and strict, always-on reserve-backing standard are explicit and already in force under Law N° 023/2026.

What remains undetailed in the sourcing reviewed this cycle is the redemption-right mechanics available to stablecoin holders, and whether any systemic-designation framework exists for stablecoin issuers that reach sufficient scale to raise financial-stability concerns of their own. These are meaningful operational gaps in an otherwise clearly specified reserve regime, and they sit at the intersection of stablecoin regulation and payment-system oversight that the CMA-BNR coordination requirement is designed to manage.

Outlook

Watch for whether implementing regulations, or separate BNR guidance, address redemption rights and systemic-designation criteria, particularly once the first stablecoin issuer approaches CMA for issuance approval.

Cross-Border Transfer

Virtual assets are not legal tender in Rwanda and cannot be used as a direct means of payment unless the National Bank of Rwanda specifically authorises such use. This restriction is clearly and directly sourced, carrying a probable confidence tier, even though the precise statutory provision establishing it has not been confirmed against primary Gazette text. The restriction functions as a default prohibition on payment use with a conditional carve-out: the National Bank of Rwanda retains discretionary authority to permit specific payment uses, but no general payment right exists absent that authorisation.

This payments restriction is the clearest sourced fact bearing on cross-border transfer in the current record, but it is a restriction on domestic payment use rather than a comprehensive cross-border transfer framework. No rule has been identified addressing the mechanics of cross-border virtual-asset transfers specifically — questions such as outbound transfer reporting, correspondent-style intermediary obligations for virtual-asset service providers, or foreign-exchange-control interaction with virtual-asset movement remain unaddressed in the sourced material. The amber posture on this module reflects that the one confirmed rule is significant but narrow, leaving the broader cross-border transfer question largely open.

The conditional structure of the National Bank of Rwanda's authorisation power is worth noting as a design feature: rather than an outright ban, the law leaves room for the central bank to permit specific payment-related uses of virtual assets as circumstances warrant, which suggests a regime designed for calibrated rather than permanent restriction.

Outlook

Whether the National Bank of Rwanda will exercise its authorisation power to permit any specific payment use of virtual assets, and whether implementing regulations will address cross-border transfer mechanics more directly, are both open questions not yet resolved in the sourced material. Developments on either front would be the clearest signal of this module's trajectory going forward.

Cross-Border Transfer

Law N 023/2026 establishes that virtual assets are not legal tender in Rwanda and cannot be used as a direct means of payment unless specifically authorised by the National Bank of Rwanda. For any cross-border payment architecture that routes value through virtual assets into or out of Rwanda, this provision is the controlling constraint: settlement in virtual assets as a substitute for fiat payment is closed by default, and opened only by a specific National Bank of Rwanda authorisation that has not, on the evidence reviewed, yet been granted or published in any identified instance.

This payments restriction is structurally distinct from the Capital Market Authority licensing requirement for virtual asset service provision, and the two should not be conflated. An entity could, in principle, be licensed by the Capital Market Authority to provide virtual asset services such as exchange or custody while remaining entirely unable to use virtual assets as a payment instrument for ordinary commercial settlement absent separate National Bank of Rwanda authorisation. For cross-border transfer use cases specifically, meaning the use of virtual assets to move value across Rwanda's borders as a substitute for conventional payment rails, the binding question is the central bank authorisation, not the Capital Market Authority licence.

The practical effect is that virtual-asset-based remittance or payment corridors touching Rwanda face a second, independent regulatory gate beyond service-provider licensing. A provider licensed to operate a virtual asset exchange or wallet service is not, by virtue of that licence alone, authorised to facilitate payment settlement in virtual assets; that requires the separate and currently ungranted National Bank of Rwanda authorisation referenced in the statute.

Outlook

The development to watch is any National Bank of Rwanda authorisation, guidance, or framework permitting virtual assets to be used as a direct means of payment under the statutory exception. No such authorisation has been identified in the material reviewed this period. Until one is published, cross-border payment products built on virtual asset settlement into or out of Rwanda should be assessed as falling outside the currently authorised perimeter, regardless of whether the operating entity holds a Capital Market Authority service licence.