The virtual asset sector has entered a new regulatory phase following the publication of the 2026 Law on Virtual Asset Business in the Official Gazette on May 28. The legislation introduces a comprehensive framework for cryptocurrencies and other virtual assets, establishing broad regulatory principles while leaving detailed implementation rules to be developed by regulators. ALSO READ: What to know about new draft law on virtual assets Although the law is now in force, key operational requirements are still being formulated. What the law establishes The Capital Market Authority (CMA) has been designated as the lead regulator for virtual asset activities, working alongside the National Bank of Rwanda (BNR) on issues related to financial stability, payment systems, and systemic risk. Only incorporated legal entities will be allowed to provide virtual asset services, effectively barring individuals from operating in the sector. The law also makes clear that virtual assets are not legal tender and cannot be used as a means of payment unless specifically authorised by the central bank. ALSO READ: Parliament passes bill on virtual assets, cryptocurrencies Several activities are prohibited unless expressly approved by the CMA. These include cryptocurrency mining operations, virtual asset ATMs, and mixer or tumbler services used to obscure transaction flows. Marketing of virtual asset services is restricted to licensed providers or approved issuers. The law further excludes algorithmic stablecoins, privacy-focused cryptocurrencies, non-fungible tokens (NFTs), central bank digital currencies, securities already regulated under capital markets legislation, and virtual assets used within closed-loop systems. Stablecoins and tokenisation The legislation introduces strict safeguards for stablecoin issuance. Issuers must obtain CMA approval and maintain full reserve backing at all times. These reserves must be independently verified, audited, and held by licensed custodians. ALSO READ: Virtual assets law expected to boost digital finance Reserve assets must be kept separate from company funds, with issuers required to provide public proof of reserves. In the event of insolvency, stablecoin holders will be prioritised ahead of creditors. The law also permits the tokenisation of real-world assets under strict conditions. Such assets must be fully collateralised, independently valued, securely held by licensed custodians, and supported by verifiable proof of ownership and regular audits. However, sovereign assets, public infrastructure, personal data, artworks, and assets that cannot be reliably valued or legally enforced are excluded. Innovation sandbox To encourage innovation, the law establishes a regulatory sandbox jointly managed by the CMA and the National Bank of Rwanda. The sandbox will allow companies to test new virtual asset products and services within a controlled environment under regulatory supervision. Firms that successfully complete sandbox testing may apply for full licences, creating a pathway from experimentation to commercial operation. What remains undefined Despite its broad scope, the law leaves several important implementation issues to future regulations. Licensing procedures, capital requirements, liquidity ratios, reporting obligations, supervisory mechanisms, and enforcement procedures will be defined later by the CMA and BNR. As a result, businesses cannot yet determine the exact requirements for obtaining licences or meeting compliance obligations. Regulators: Details still being developed Speaking to The New Times, Jérôme Ndayambaje, a digital innovation analyst at the CMA, said the law provides overarching principles, while detailed implementation measures will be outlined in subsequent regulations. He noted that stakeholder consultations began in 2024 with a risk assessment phase before moving into policy development and drafting in 2025. “We engaged extensively with industry players,” he said, adding that public awareness campaigns and stakeholder consultations will continue during implementation. Only compliant operators will be licensed The Chairperson of the Parliamentary Committee on Economy and Trade, MP Theogene Munyangeyo, said only operators that meet regulatory requirements will be allowed to operate once the framework is fully implemented. He noted that digital assets are increasingly being transferred globally in ways similar to traditional currencies, with more than one billion people participating in crypto-related activities worldwide. Munyangeyo cited estimates showing that more than 700 million people hold virtual assets globally, with about 70 million active users. He also pointed to a global crypto market capitalisation of approximately US$2.35 trillion, with Bitcoin accounting for 57.9 per cent, Ethereum 10.6 per cent, Tether 5.9 per cent, and USDC 2.38 per cent. Regionally, he estimated there are about 4 million virtual asset users in Kenya, 2 million in Uganda, 1.5 million in Tanzania, and roughly 350,000 in Rwanda. According to him, effective regulation could help attract investment, improve cross-border payments, enhance liquidity through tokenisation of real-world assets, and support innovation, job creation, and tax revenue growth. Informal use already exists Experts say virtual assets are already being used informally in Rwanda despite the absence of a fully operational regulatory framework. Jean Pierre Bucyenyisenge, a forex mentor and CEO of PFXM, said many users currently rely on peer-to-peer trading and international exchanges. “In Rwanda, most people using cryptocurrencies do so informally, mainly through peer-to-peer trading and international platforms such as Binance and OKX. For many, it is about investment or sending money across borders more easily,” he said. He added that while adoption remains relatively limited, regulation could strengthen financial inclusion and lower cross-border transaction costs. However, he warned that the lack of clear rules has exposed users to significant risks. “Without clear rules, users have faced scams, uncertainty and lack of protection. There has also been hesitation from banks and limited public trust,” he said. Penalties already in force Although implementation regulations are still pending, criminal penalties contained in the law are already enforceable. Individuals operating virtual asset businesses without authorisation face fines ranging from Rwf30 million to Rwf50 million and up to five years in prison. Companies risk fines of between Rwf70 million and Rwf100 million. Issuing virtual assets without approval can attract fines of up to Rwf150 million, while unauthorised marketing may result in fines of up to Rwf20 million. Mining operations, crypto ATMs, and mixer services conducted without regulatory approval also attract substantial fines and possible imprisonment.
