Rwanda

Crypto Licensing

Rwanda's Law No. 023/2026 Regulating Virtual Asset Business, gazetted and in force from 28 May 2026, requires that virtual-asset service providers and issuers be licensed or approved by the Capital Market Authority, and restricts eligibility for such a licence to incorporated legal entities. This establishes the CMA as the lead regulator for the sector and creates, in principle, a licensing gateway for exchanges, custodians and other virtual-asset businesses operating in or targeting Rwanda.

The gateway is, however, enacted but not yet operational. The CMA has stated it is currently drafting secondary and implementing regulations covering licensing procedure, fit-and-proper criteria and capital requirements, and as of the most recent reporting these have not been published. No primary copy of the gazetted law's text was retrieved this cycle, so the pinpoint article numbers governing the licensing gateway, custody duties and enforcement penalties remain unconfirmed against the enacted text, though the substance of the requirement — mandatory licensing, entity-incorporation eligibility, and CMA supervisory authority — is corroborated across multiple secondary sources.

The practical consequence for a prospective entrant is that the legal basis for licensing exists but the procedural mechanism does not. An applicant cannot yet complete a licensing process because the rules governing that process have not been issued. This places Rwanda in a transitional posture: the statute signals regulatory intent and establishes the supervisory architecture, but market access for new virtual-asset businesses is effectively paused pending the CMA's secondary rulemaking.

Separately, the law prohibits specific categories of activity — cryptocurrency mining, virtual-asset ATMs, and mixer or tumbler services — unless expressly approved by the CMA. This default-prohibition approach to higher-risk activity types operates independently of the general licensing gateway and applies regardless of whether an operator holds or is seeking a virtual-asset business licence.

Outlook

The CMA's secondary regulations are expected around the first quarter of 2027. Once issued, these will determine actual market entry conditions for virtual-asset businesses in Rwanda; until then, the enabling statute is in force but the licensing gateway remains procedurally inoperative for new licensees, and the enforcement penalty regime underlying the law cannot be assessed with confidence absent the primary gazetted text.

Token Classification

Rwanda's virtual-asset law approaches token classification principally through exclusion rather than through a positively defined taxonomy. Two carve-outs are evidenced this cycle. First, non-fungible tokens are expressly excluded from the statute's definition of "virtual asset," meaning NFT activity in Rwanda sits outside the scope of the CMA's virtual-asset licensing and supervisory regime entirely, at least as that regime is currently constituted. Second, within the category of fiat-referenced tokens, a distinction is drawn between stablecoins that meet full-reserve, CMA-approved, custodian-held criteria — which are treated as regulated stablecoins — and algorithmic stablecoins, which are excluded from that regulated-stablecoin treatment.

This carve-out structure has a practical implication for any entity seeking to classify a specific token under Rwandan law: the relevant question is not which affirmative category the token fits, but which exclusion applies to it, if any. A token that does not fall within an express carve-out presumably falls within the general virtual-asset definition and its associated licensing and compliance obligations, though the general definition itself was not independently retrieved from the primary gazetted text this cycle.

The classification approach corresponds to the broader structure of Law No. 023/2026, under which the CMA is positioned as the body responsible for determining how specific instruments are treated, including through its approval function over stablecoin issuance and its supervisory role over tokenisation of real-world assets. No classification detail specific to security-type tokens, utility tokens, or governance tokens was located this cycle.

Outlook

The pending CMA secondary regulations, expected around the first quarter of 2027, are the most likely vehicle for further elaboration of the classification taxonomy, including any additional carve-outs or sub-categories within the virtual-asset definition. Until then, classification questions for novel token types in Rwanda default to the exclusion-based framework set out in the primary law.

On-Chain Activity Regime

Rwanda's treatment of on-chain activity under Law No. 023/2026 is, at this stage, narrowly addressed rather than comprehensive. Two specific activities are explicitly covered. Cryptocurrency mining operations are prohibited unless expressly approved by the Capital Market Authority, placing mining under a default-prohibition regime rather than a permissive or unaddressed one. Separately, the CMA approves and supervises tokenisation of real-world assets as a defined regulatory function, indicating that real-world-asset tokenisation is treated as a distinct, CMA-governed activity category rather than being left to fall under general virtual-asset licensing alone.

Beyond these two activities, the on-chain activity regime is substantially undeveloped in the available sourcing. No provision addressing staking, decentralised-finance lending, decentralised exchanges, or validator-node operation under Rwandan law was located this cycle, despite active search. This is treated as a genuine research gap rather than a confirmed absence of regulation: it reflects a structurally thin area of sourcing for an emerging-market jurisdiction's on-chain activity framework, not necessarily an absence of any rule governing these activities under the broader statute or forthcoming secondary regulation.

The combination of an explicit mining prohibition-absent-approval and an explicit tokenisation-supervision function, against a backdrop of unaddressed DeFi and staking treatment, suggests the law was drafted with particular attention to two specific activity types rather than as an exhaustive on-chain activity code. Where it is silent, the general virtual-asset licensing and consumer-protection provisions of the statute would presumably apply by default, though this inference is not independently confirmed against primary text.

Outlook

Whether the CMA's forthcoming secondary regulations will extend specific treatment to staking, DeFi and validator activity is not yet known. Market participants engaging in on-chain activity beyond mining and real-world-asset tokenisation should treat the absence of specific rules as an open question rather than as settled permissiveness, pending further primary-source retrieval or the CMA's secondary rulemaking.

Stablecoin Regime

Rwanda's stablecoin regime under Law No. 023/2026 is built on an authorisation-plus-reserve model. Stablecoin issuers must obtain Capital Market Authority approval before issuing a fiat-referenced token, and reserves backing any issued stablecoin must be maintained in full at all times and be independently verified and audited by a licensed custodian. This combination — prior approval and continuous full-reserve verification — places Rwanda's stablecoin framework in line with reserve-backing principles seen in more developed regimes, albeit set out at the level of primary law rather than through a detailed prudential rulebook.

The classification carve-out that excludes algorithmic stablecoins from this regulated-stablecoin treatment means the full-reserve and custodian-audit requirements apply specifically to fiat-referenced, full-reserve instruments, not to algorithmic designs; the regulatory status of an algorithmic stablecoin issued into or targeting the Rwandan market is accordingly less clear and was not resolved by any source reviewed this cycle.

A joint regulatory sandbox, managed by the CMA together with the National Bank of Rwanda, permits controlled testing of novel virtual-asset products, including presumably novel stablecoin designs, with a stated pathway from successful sandbox completion to a full licence. This sandbox mechanism offers a route for market entry that does not require immediate compliance with the full licensing framework, which is otherwise not yet operational pending secondary regulation. The minimum capital figure applicable to stablecoin issuers has not been located in any source this cycle and is understood to be a matter left to the CMA's pending secondary regulation.

Outlook

The detailed prudential rulebook for stablecoin issuance — including minimum capital, operational-risk requirements and the mechanics of custodian audit — remains pending CMA secondary regulation, expected around the first quarter of 2027. Until then, the full-reserve and prior-approval principles set in primary law are the operative standard, with the joint CMA/BNR sandbox offering the only confirmed near-term route to market testing.

Consumer Protection

Law N° 023/2026 restricts marketing of virtual asset services to licensed providers or approved issuers, a protection aimed at preventing unlicensed offerings from being promoted to Rwandan consumers before any licensing regime is fully operative. Separately, the National Bank of Rwanda has stated that virtual assets are not legal tender and cannot be used as a direct means of payment for goods, services, or financial obligations unless explicitly authorised by BNR, a general protection against virtual assets being represented as, or relied upon as, a guaranteed payment mechanism.

Both protections are explicit and already in force. What is not detailed in the sourcing reviewed this cycle is any dedicated complaint-handling mechanism or consumer-redress pathway specific to virtual-asset services, separate from Rwanda's general consumer-protection law.

Outlook

Watch for whether implementing regulations articulate a dedicated redress pathway for virtual-asset consumers, and whether the marketing restriction is tested against unlicensed offerings once CMA begins active supervision.