RwandaLaw regulating virtual asset business, Technology and Information Security
Law No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 28
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a virtual asset service provider, a legal entity registered and licensed in Rwanda to provide virtual asset services in or from Rwanda (reached by declaring that you are a crypto-asset provider).
- Implement effective systems, processes, controls, policies and procedures to handle risks, including cyber security-related risks to your business and virtual asset activities, and the safety of virtual assets and customer information, with resilient technology systems that can reliably handle large transactions and business continuity arrangements, including backup or disaster recovery systems, facilities and sites (Article 28(1)).
- Make your technology risk management framework address the risks of generating cryptographic keys or virtual asset wallets, signing and approving transactions, storing cryptographic keys and seed phrases, and creating and managing virtual asset wallets (Article 28(2)).
- Establish and maintain sound operational standards, including robust cybersecurity measures, financial reporting standards and internal controls, so that your services are reliable and secure (Article 28(3)).
- Keep the platform and your other virtual asset activities running without interruption by maintaining proper backup infrastructure, establishing and implementing a disaster recovery and business continuity plan, periodically testing both, and keeping an information technology system that meets requirements for data readiness, protection, integrity and quality (Article 28(4)).
- Have your technology and information security framework periodically audited and verified by an independent and qualified auditor in technology and information security (Article 28(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Capital Market Authority of Rwanda, the Regulatory Authority under the Law, which is vested with the power to take the enforcement actions necessary for the implementation of the Law; administrative faults and sanctions are set by regulations.
What this law does
Article 28(1) of the Law requires a virtual asset service provider to implement effective systems, processes, controls, policies and procedures to handle risks, including cyber security-related risks to its business and virtual asset activities, and the safety of virtual assets and customer information.
Article 28(2) requires the provider's technology risk management framework to address the risks associated with the generation of cryptographic keys or virtual asset wallets, the signing and approval of transactions, and the storage of cryptographic keys and seed phrases. Article 28(3) requires the provider to establish and maintain sound operational standards, including robust cybersecurity measures.
Article 28(4) requires the provider to keep its operations running without interruption by maintaining backup infrastructure and a disaster recovery and business continuity plan and by periodically testing them. Article 28(5) requires the provider's technology and information security framework to be periodically audited and verified by an independent and qualified auditor. The Regulatory Authority is the Capital Market Authority of Rwanda.
The Law comes into force on the date of its publication in the Official Gazette. That publication is the Special issue of .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.