Rwanda: technology regulation at a glance

Framework: Virtual Asset Business Law (unanimously passed by Chamber of Deputies 5 May 2026, awaiting presidential assent and Official Gazette publication); Capital Markets Authority Rwanda (CMA) as primary regulator; National Bank of Rwanda (NBR) as co-ordinating monetary/payment authority

Rwanda's Parliament unanimously passed a comprehensive Virtual Asset Business Law on 5 May 2026, designating the Capital Markets Authority as the principal licensing and supervisory body for all virtual asset service providers. The law establishes Rwanda's first formal regime for crypto exchanges, custodians, token issuers, and stablecoin providers, but has not yet entered into force pending presidential assent and gazetting. The CMA had already been directing VASPs to seek licences and warning of prosecution under draft provisions enforced from March 2025, signalling active regulatory intent ahead of formal commencement.

Framework: National AI Policy (Cabinet-approved April 2023), administered by the Ministry of ICT and Innovation (MINICT) and Rwanda Information Society Authority (RISA); Responsible AI Office (RAI Office) established within MINICT for coordination

Rwanda's Cabinet approved a National AI Policy in April 2023, making it among the first African countries to adopt a dedicated national AI policy. The policy is a non-binding strategic framework, no binding AI-specific legislation has been enacted as of May 2026. Governance rests on voluntary principles, ethical guidelines, and a Responsible AI Office housed within MINICT.

Framework: Law No. 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy, enforced by the National Cyber Security Authority (NCSA) / Data Protection & Privacy Office (DPO)

Rwanda enacted its first comprehensive data protection law, Law No. 058/2021, gazetted on 15 October 2021, with full mandatory compliance in force from 15 October 2023. The law closely mirrors GDPR principles, covering consent, data subject rights, breach notification, and cross-border transfer controls. The National Cyber Security Authority (NCSA), through its dedicated Data Protection & Privacy Office (DPO), serves as the supervisory authority responsible for registration, enforcement, and regulatory guidance.

Framework: National Payment System Law (2010); Regulation n° 74/2023 Governing Payment Service Providers; Regulation n° 54/2022 on Electronic Money Issuers, all overseen by the National Bank of Rwanda (BNR)

Rwanda operates a mature, multi-tiered licensing regime for digital payments and fintech, administered exclusively by the National Bank of Rwanda (BNR). Regulation n° 74/2023 (in force September 2023) introduced four PSP licence categories with differentiated capital requirements and mandated full recategorisation of all existing licences by September 2024. Rwanda has simultaneously built out instant-payment infrastructure, a regulatory sandbox, and cross-border licence-passporting agreements, positioning itself as a leading fintech hub in East Africa.

Framework: Law N°57/2018 of 13/08/2018 on Immigration and Emigration in Rwanda; administered by the Directorate General of Immigration and Emigration (DGIE) under the Ministry of Internal Affairs

Rwanda has no dedicated digital nomad visa listed on its official immigration portal as of May 2026. Remote workers with foreign-sourced income may use the K permit (assured income, for those not intending local employment) as the closest existing long-stay pathway. Short-term remote work is feasible under tourist/visitor visas, and investors or entrepreneurs can access sector-specific investor permits, but no purpose-built digital nomad programme has been officially confirmed.

Framework: Law No. 60/2018 on Prevention and Punishment of Cyber Crimes; Law No. 058/2021 on Protection of Personal Data and Privacy; Ministerial Instruction on Child Online Protection (January 2024); Rwanda Utilities Regulatory Authority (RURA) oversight

Rwanda's internet and online safety regulation is governed by a patchwork of laws rather than a single comprehensive statute. The 2018 Cybercrime Law criminalises unlawful online content and requires ISPs to remove illegal material, while a January 2024 Ministerial Instruction mandates content filtering and age-verification by digital platforms to protect children. In practice, the regime is characterised by significant state control: foreign news websites remain blocked, biometric SIM registration is required, and laws criminalising 'false information' are used against online critics, with Freedom House rating Rwanda 'Not Free' in its 2024 and 2025 Freedom on the Net reports.

Framework: Law No. 26/2017 (NCSA Establishment), Law No. 60/2018 (Prevention and Punishment of Cyber Crimes), Law No. 058/2021 (Personal Data and Privacy Protection), RURA Cybersecurity Regulation No. 010, and National Cybersecurity Strategy 2024-2029, administered by the National Cyber Security Authority (NCSA)

Rwanda operates a multi-layer cybersecurity legal regime anchored by a dedicated authority (NCSA), a standalone cybercrime law, and a data-protection law that doubles as a breach-notification framework. Sector-specific obligations overlay the baseline for telecommunications, finance, public institutions, and essential-service providers. A National Cybersecurity Strategy 2024-2029 sets seven objectives including critical infrastructure protection, risk management, and international cooperation.

Framework: Companies Act No. 17/2018 and Investment Code No. 06/2021, administered by the Rwanda Development Board (RDB) / Office of the Registrar General (ORG)

Rwanda offers one of Africa's most streamlined business registration environments: foreigners may own 100% of a locally incorporated company in most sectors, registration is completed fully online within six working hours at no cost, and there is no statutory minimum capital requirement. The RDB's Office of the Registrar General processes incorporations through a digital one-stop portal that simultaneously issues a tax identification number via the Rwanda Revenue Authority.