Crypto regulation in Zimbabwe has taken on a new dimension with the 2026 rules targeting virtual asset service providers. The FIU now provides forms and dedicated documents for VASPs, while the SECZ has issued a notice on the sector. The key is understanding each institution’s remit without confusing AML registration with full commercial approval.
The rules cannot be read in isolation. A crypto exchange, custodian, payment service and token issuer may fall under different responsibilities. For users, this distinction shows what to check. For businesses, it prevents them from launching a product based on a single administrative form.
In brief
- The FIU publishes VASP procedures and oversees obligations aimed at combating illicit financial flows.
- FIU registration does not prove that every activity has all the required authorizations.
- The SECZ’s role depends on the service and financial product being offered.
Understanding the VASP framework
The BrefCrypto guide to crypto in Zimbabwe describes the local market. For service providers, the FIU’s VASP portal says the institution oversees Virtual Asset Service Providers to prevent money laundering and terrorist financing. The page provides a registration form, AML/CFT guidelines, a risk document, the Travel Rule and legislative texts.
The portal refers to Statutory Instrument 99 of 2026 and the Money Laundering and Proceeds of Crime Act. Law No. 7 of 2025 also amended provisions targeting VASPs. These texts document an AML framework for the professional activities concerned; they do not constitute a universal license validating every product or business practice.
The FIU provides the VASPR1 form. This process is intended to identify entities within its supervisory remit. It is not a guarantee of solvency, a technology certification or an investment recommendation. Customers should not interpret registration as assurance that they will be repaid.
The FIU and SECZ answer different questions
The FIU addresses illicit financial risks and AML compliance for the providers concerned. The SECZ oversees activities and products falling within its remit relating to capital markets. These roles may overlap for certain business models, but neither replaces the other. A spot exchange is not automatically in the same position as an operator selling a product resembling a security or managing a collective investment scheme.
The SECZ published a public notice on virtual assets and VASPs in June 2026. Its existence confirms that the authority has addressed the sector, but the title alone does not establish that a company is licensed. The full content, legal references and conditions it mentions must be reviewed. If there is uncertainty over a token, a return promise or a brokerage activity, the actual product must be analyzed.
Law No. 7 of 2025, which amended financial and AML legislation, may also affect provider registration and compliance responsibilities. Separate obligations may apply to money transfers, payments or foreign-exchange transactions. The fact that a company requests KYC documents does not demonstrate that it holds a payment, brokerage or custody license.
The BrefCrypto guide to crypto platforms and their status in Africa recommends starting with the legal name and contracting entity, then comparing the service provided with the authority’s remit. An international brand may cover several companies. The agreement governing your account is more useful than a recognizable logo.
Registration, authorization and licensing are distinct concepts
Registration creates an administrative record in a register or through a process with an institution. Authorization permits certain activities under specified conditions. A license, meanwhile, may refer to a specialized approval, but its meaning depends on the relevant text. These terms are not interchangeable, and a company may hold a status for one service without being entitled to offer its entire catalog.
The central point in Zimbabwe is that the FIU presents the VASP framework as part of the fight against money laundering. FIU registration should not be marketed as a general commercial authorization. The right questions are: which authority, which rule, which product, which audience, which activity and which condition? Until those elements are clear, a “regulated” badge says little about user protection.
An operator may be registered with the authority responsible for AML and still need another authorization depending on its activity. Conversely, a foreign provider may display a license obtained in another country. The contract should state which company is responsible for the account and which avenues of recourse remain available to a Zimbabwean resident.
Users should be wary of certificates that are difficult to verify. Check the company name in the official register or document, along with the date, number, covered activity and any restrictions. If the website mentions only a group company without identifying the entity serving the customer, request written clarification from official support.
What should you check before depositing?
The first check concerns the contracting entity. Open the terms from the official domain and look for the legal name, country of incorporation, address and complaints mechanism. An advertisement or search-engine result may point to a different subsidiary from the one holding the account. If the application directs you to an unclear document, do not transfer funds until you have identified the responsible company.
The second check concerns the claimed status. Use the FIU’s and SECZ’s official pages, then verify the scope of the registration. A company may appear in a database without every feature being covered. Also examine custody rules, withdrawals, processing times, limits and fees. Access to an application or the ability to create an account confirms neither product coverage nor local recourse.
The BrefCrypto guide to crypto KYC in Africa explains how to assess identification requests and protect your documents. A service may request information to meet its obligations, but it should clearly state its policy and identity. Someone asking for your passport on Telegram is not an official channel. Do not send a copy of an identity document through a link you received without verifying it yourself.
The payment process deserves a separate check. Verify who receives the payment, whether the beneficiary matches the company or the P2P instructions, and how the transaction will be documented. An AML-registered provider does not guarantee a fiat transfer or the absence of fraud. Receipts, confirmations, contracts and transaction IDs may prove useful if a dispute arises.
What registration does not say about tax
AML registration does not automatically determine the tax treatment of a crypto gain. In October 2026, ZIMRA published a presentation of research by an award-winning academic. The researcher notably argues that the AML framework is not, by itself, a complete tax code for digital assets and that a more explicit law could clarify their treatment. This is research analysis made public by the administration, not a new law or an official decision applicable to all taxpayers.
This distinction matters. Readers cannot infer that their gains are not taxable, that a transaction is always outside the tax system or that an FIU form constitutes a tax return. The rules may depend on the nature of the income, the frequency of transactions, professional status and the tax legislation in force. Supporting documents should be retained, and local advice sought when the amounts or activity warrant it.
FIU registration also does not promise reimbursement in the event of bankruptcy, hacking or the loss of a key. Complaints and remedies depend on the contracts and applicable law. Ask whether funds are held on behalf of the customer, by a third-party custodian or together with operating assets. A service may comply with its AML obligations while still presenting custody risk.
The Mozambique crypto guide and the legal guides on Togo offer points of comparison, but they concern different national rules. A license in a neighboring country does not automatically authorize activity in Zimbabwe. To avoid confusion, each legal document should be dated and linked to the territory it covers.
Document your model and date your checks
A platform project should map its flows: source of funds, conversion, custody, withdrawals, partners and complaint handling. Each stage may create a responsibility. The team should know whether it controls a key, holds a payment, transmits an order or advises a customer. This mapping makes discussions with lawyers and authorities more precise than a sales presentation.
Compliance is not limited to forms. KYC, monitoring, record-keeping and alert-handling procedures must be defined in line with the applicable obligations. If a token grants rights in a company or promises a return, its review must go beyond the underlying code. The SECZ or local counsel may need to examine the product and its distribution.
Partnerships with a bank or mobile operator do not automatically transfer their license to a crypto provider. A written agreement should specify the covered service, territory and responsibilities. A visible technical integration is not regulatory approval.
Zimbabwe now has an FIU registration framework for virtual asset service providers, with obligations linked to AML risks. The SECZ has also published a notice on the sector. These elements alone do not determine the legality of every product or the status of every platform. The scope depends on the actual activity and the texts applicable on the relevant date.
The presentation published by ZIMRA on tax research relating to digital assets highlights another useful distinction: academic work presented by the administration is not a new tax law. Individuals and businesses should date their notes and verify the legislation in force rather than derive a universal rule from a single statement.
Before depositing, check the entity, service, claimed status and available remedies. Before launching an activity, map the flows and seek a local compliance analysis. This approach avoids turning a limited registration into an imaginary guarantee, while recognizing that the framework has evolved since the general warnings issued in previous years.
