RwandaLaw regulating virtual asset business, Notifiable Events Including Cyber-Attacks
Law No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 21(1)(b)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a virtual asset service provider, a legal entity registered and licensed in Rwanda to provide virtual asset services in or from Rwanda (reached by declaring that you are a crypto-asset provider).
- Notify the Capital Market Authority of Rwanda immediately, in writing, where you suspect or have reason to believe that a cyber-attack, including attempted events, that may affect your operations and customers is likely to occur or has occurred (Article 21(1)(b)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Capital Market Authority of Rwanda, the Regulatory Authority under the Law, which is vested with the power to take the enforcement actions necessary for the implementation of the Law; administrative faults and sanctions are set by regulations.
What this law does
Article 21(1) of the Law requires a virtual asset service provider to notify the Regulatory Authority immediately, in writing, where it suspects or has reason to believe that a cyber-attack, including attempted events, that may affect operations and customers is likely to occur or has occurred. The same paragraph also requires immediate notice of the provider's involvement in criminal proceedings and of its opening or ceasing virtual asset business outside Rwanda.
The Regulatory Authority is the Capital Market Authority of Rwanda. The Law comes into force on the date of its publication in the Official Gazette. That publication is the Special issue of .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.