This guide sets out the key distinctions for individuals and businesses. It does not replace legal advice, particularly when marketing a service, using tokens for payments or structuring a cross-border activity.
Crypto legality in Rwanda: start with the law in force
Our coverage of crypto in Rwanda traces the national context. For assessing a current transaction, the primary reference remains Law No. 023/2026 of 25 May 2026 governing virtual asset business, published in the special Official Gazette on 28 May. Article 40 provides that it entered into force upon publication.
The official version available from the Capital Market Authority sets out the provisions in several languages. A policy announcement, an earlier draft or a commercial summary should not be treated as a substitute. Always note the version and date of the document consulted.
The law creates a supervisory framework for certain activities while setting explicit limits. Saying that Rwanda “bans all crypto” overlooks this new structure. Conversely, claiming that “everything has operated freely since the law” ignores licensing requirements, payment restrictions and the distinction between individuals and legal entities.
The analysis must also account for the regulations, directives and decisions applicable on the date of the transaction. The law leaves several procedures to the authorities. A general guide cannot invent their content or conclude that no additional obligation exists simply because no relevant page appeared in a search engine.
Distinguish holding, buying and commercial activity
Holding private keys, buying through a service and regularly selling on behalf of clients are different types of conduct. The law broadly defines virtual asset business and related services. Article 15 prohibits individuals from conducting or claiming to conduct such business in Rwanda.
This provision does not, without further analysis, mean that simply holding a wallet for personal use constitutes commercial activity. It does, however, prevent an individual seller from being considered automatically authorized merely because they operate under their own name or post an offer on a P2P interface.
Individuals should identify themselves as clients and verify the provider’s status. A business that exchanges, holds or transfers assets for others must examine the requirements applicable to its own activity. Rebranding “exchange” as “support” does not neutralize the acts actually performed.
For technical use cases, certain exclusions from the law’s scope also require careful reading. Providing hardware support or developing software does not necessarily amount to holding assets for clients. Once an operator controls funds or executes transactions, the analysis must focus on that specific service.
Who supervises virtual asset service providers?
The Capital Market Authority, or CMA, acts as the regulator for virtual asset business. The law gives it licensing and supervisory powers, along with responsibilities concerning issuers and certain products. An institutional logo displayed on a website does not prove that these controls are being exercised.
The National Bank of Rwanda retains an essential role regarding currency, payments and risks affecting the financial system. The law provides for cooperation between the two authorities. Depending on the transaction, questions concerning the crypto provider and the payment method may therefore fall under separate areas of authority.
Before relying on an alleged license, compare the legal name, number, holder, activity and validity period. A company within a group does not automatically benefit from every authorization granted to its subsidiaries in other countries. The entity named in your contract must be the one actually authorized.
The method outlined in our guide to crypto platforms in Africa and their regulatory status helps structure this verification. It notably avoids confusing business registration, payment authorization and the right to provide virtual asset services.
Bitcoin and USDT do not replace the Rwandan franc
Article 15 specifies that virtual assets are not legal tender. Their direct use to settle goods, services, debts or other financial obligations requires authorization from the National Bank of Rwanda. A merchant’s voluntary acceptance is therefore not enough to establish that the payment is compliant.
An invoice denominated in RWF and settled through an intermediary may raise different questions from a direct token transfer to the seller. The entire structure must be understood: who receives the assets, who converts them, who makes the final payment and under which authorizations. The presence of a conversion does not by itself create an exemption.
A business that wants to accept crypto should seek an assessment before offering that option to customers. The issues also involve contracts, accounting, taxation and payment controls. A rapid technical integration resolves none of these dimensions.
For individuals, caution means keeping ordinary payment methods available. Holding tokens does not guarantee the ability to pay an urgent expense legally and without delay. Prices, fees and conversion terms may also change between the purchase and the spending.
Stablecoins have specific rules
The term stablecoin covers several structures. A token targeting the dollar, an asset backed by reserves and an algorithmic mechanism do not have the same characteristics. Rwandan law addresses these differences rather than treating every promise of stability as equivalent.
Article 19 requires prior approval for issuing stablecoins in Rwanda or listing them on an approved Rwandan exchange. It sets out requirements concerning collateral, the segregation of reserves and controls, among other matters. Applying the provision to a specific product requires verification, not an assumption based on its international profile.
USDT and USDC should therefore not be described as “approved in Rwanda” without specific evidence. An issuer’s documentation about its reserves addresses a financial question; it does not replace a decision by the Rwandan authority concerning a product or its local listing.
Certain categories excluded from the law’s scope, including algorithmic stablecoins, are not thereby freely authorized. An exclusion means that the provisions concerned do not apply in the same way; it does not provide a general permit to issue, sell or use the assets for payments.
P2P does not eliminate obligations
A peer-to-peer marketplace may arrange matching, proof of payment and escrow. These functions may reduce certain operational risks, but they do not change the nature of the activity carried out by the parties. Legality does not follow from a positive rating or a large number of completed transactions.
The restriction on individuals conducting virtual asset business requires particular caution in Rwanda. A user who regularly offers to convert funds for others cannot rely solely on a platform’s internal rules. The required status must be independently verified.
A payment through mobile money does not create an implicit crypto authorization. The mobile wallet operator provides a separate service. Our guide to buying cryptocurrencies with mobile money explains why fiat payment and blockchain delivery should remain separate in the analysis.
Do not use borrowed accounts, concealed beneficiaries or false justifications to bypass controls. A restriction does not disappear because a transaction moves to a private messaging channel. Such workarounds also make evidence and remedies more difficult to pursue.
Sandbox programs, advertising and technical activities
The law provides for a testing framework for innovative activities under certain conditions. Admission to a sandbox is not a permanent license valid for every service. The scope, participants and limits of the test should guide its interpretation.
After a successful test, the participant may apply for an appropriate license or authorization. This possibility does not guarantee that the authorization will be granted. For a client, a claim that a service was “tested with the regulator” therefore requires verification of the current status and the service actually covered.
The law also governs the marketing of virtual assets or related activities by authorized legal entities. An influencer, referral partner or consulting firm must examine the role it actually plays when directing clients toward an offering. Ambiguous promotional language can go beyond simply providing information.
Activities such as mining, crypto ATMs and mixing services are also subject to authorization requirements under Article 15. The technical launch of equipment should not precede the regulatory review. The parties concerned should document their exchanges with the competent authorities.
Tax, records and remedies: three separate issues
An authorized activity may generate tax obligations. Conversely, reporting income does not prove that the service that generated it held all the necessary authorizations. No universal crypto tax rate or general exemption should be inferred solely from the existence of the 2026 law.
Keep records of purchases, sales, commissions, transfers and their values in RWF, together with the relevant dates. A qualified tax professional can then classify the transactions according to your circumstances. This documentation also helps when providing evidence about the source of funds.
For a dispute, identify the contract, company, complaints channel and available evidence. A blockchain identifier demonstrates a technical movement of funds, but not always the complete performance of a commercial obligation. Add relevant fiat receipts and contractual communications while protecting personal data.
Our guide to KYC controls and remedies in Africa helps reduce transmission errors. No legitimate support service needs your seed phrase to assess whether a purchase complies with the rules.
The right question: what act, by whom and under what status?
A sound decision distinguishes the client, the commercial activity, the payment method and the product. Check each element instead of looking for a general sentence authorizing every use. When the provider’s status or the treatment of the transaction remains uncertain, stop the process and obtain a qualified answer.
Rwanda now has a legal framework governing part of the sector. This development deserves close reading: it creates regulated pathways, not unrestricted freedom. The quality of the verification matters more than the apparent ease offered by an application.
