Provides financial services, in Rwanda

National Bank of Rwanda Regulation N° 50/2022 of 02/06/2022 on Cyber Security in Regulated Institutions, art. 21 · Read the law's page

• This binds every regulated institution, meaning any financial institution licensed and supervised by the National Bank of Rwanda, unless a specific regulation or directive provides otherwise (reached by declaring that you provide financial services). Regulation N° 50/2022 came into force on 17 June 2022, and article 26 gave an institution that did not comply one year from its publication to comply.
• Notify the National Bank of Rwanda as promptly as possible, and within two hours of the occurrence of the incident or of a determination that a cyber security incident has occurred, where the incident may disrupt you from continuing your normal operations for customer-facing transactions or has a reasonable likelihood of materially harming any material part of your normal operations (article 21).
• Submit the full incident report to the National Bank of Rwanda within 24 hours of the occurrence of the incident, in the format of Appendix 1 to the Regulation (article 21).
• Follow any specific incident reporting requirement the National Bank of Rwanda provides in a Directive (article 21).

National Bank of Rwanda Regulation N° 50/2022 of 02/06/2022 on Cyber Security in Regulated Institutions, arts. 2-20 and 22 · Read the law's page

• This binds every regulated institution, meaning any financial institution licensed and supervised by the National Bank of Rwanda, unless a specific regulation or directive provides otherwise (reached by declaring that you provide financial services). Regulation N° 50/2022 came into force on 17 June 2022, and article 26 gave an institution that did not comply one year from its publication to comply.
• Make the Board of Directors and Senior Management responsible for cyber security governance, with a governance framework that includes a cyber security strategy linked with business objectives, a governing security programme, metrics and monitoring processes and crisis management practices (article 4).
• Keep an IT security function with qualified staff and an IT Steering Committee that meets at least quarterly, unless a specific regulation or directive provides otherwise (articles 6 and 7).
• Implement and maintain a written cyber security policy approved by the board and based on your risk assessment, covering at least the areas article 9 lists, including cyber incident management and vendor and service provider management (article 9).
• Conduct at least annual penetration tests and bi-annual vulnerability assessments, using assessors who hold one of the qualifications article 10 lists, and share an executive summary of the findings with the National Bank of Rwanda within fifteen days after the test (article 10).
• Use risk-based multi-factor authentication, required for any individual accessing your internal networks from an external network unless the head of the IT security function has approved in writing an equivalent or more secure access control (article 16).
• Protect non-public data held or transmitted by you, in transit over external networks and at rest, with controls including encryption (article 19).
• Establish a written incident response and business continuity management plan (article 20).
• Assess the cyber security of your service providers, run a security awareness programme for the board, staff and third parties, and keep a data retention policy for non-public data (articles 14, 17 and 18).
• Submit to the National Bank of Rwanda, not later than 15 January each year, a written statement of self-assessment certifying that your cyber security strategy complies with the Regulation (article 22).

Law No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 21(1)(b) · Read the law's page

• This binds a virtual asset service provider, a legal entity registered and licensed in Rwanda to provide virtual asset services in or from Rwanda (reached by declaring that you are a crypto-asset provider).
• Notify the Capital Market Authority of Rwanda immediately, in writing, where you suspect or have reason to believe that a cyber-attack, including attempted events, that may affect your operations and customers is likely to occur or has occurred (Article 21(1)(b)).

Law No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 28 · Read the law's page

• This binds a virtual asset service provider, a legal entity registered and licensed in Rwanda to provide virtual asset services in or from Rwanda (reached by declaring that you are a crypto-asset provider).
• Implement effective systems, processes, controls, policies and procedures to handle risks, including cyber security-related risks to your business and virtual asset activities, and the safety of virtual assets and customer information, with resilient technology systems that can reliably handle large transactions and business continuity arrangements, including backup or disaster recovery systems, facilities and sites (Article 28(1)).
• Make your technology risk management framework address the risks of generating cryptographic keys or virtual asset wallets, signing and approving transactions, storing cryptographic keys and seed phrases, and creating and managing virtual asset wallets (Article 28(2)).
• Establish and maintain sound operational standards, including robust cybersecurity measures, financial reporting standards and internal controls, so that your services are reliable and secure (Article 28(3)).
• Keep the platform and your other virtual asset activities running without interruption by maintaining proper backup infrastructure, establishing and implementing a disaster recovery and business continuity plan, periodically testing both, and keeping an information technology system that meets requirements for data readiness, protection, integrity and quality (Article 28(4)).
• Have your technology and information security framework periodically audited and verified by an independent and qualified auditor in technology and information security (Article 28(5)).