Rwanda

Sets rules for labelled bonds: at least 75% of net proceeds of a use-of-proceeds bond go to eligible projects (Arts. 2, 8.1), a pre-issuance external review and annual allocation and impact reporting (Arts. 4.3, 6.1), and CMA power to require removal of the label for unlisted bonds on sustainability washing (Arts. 12-13). Took effect on signature (Art. 15).

Sets how fintech firms test capital-markets products in a CMA sandbox. Applicants must be incorporated in Rwanda or licensed by an equivalent securities regulator (Art. 8) and may apply at any time; testing lasts up to twelve months, with an extension of up to six months (Arts. 10-11). Published in Official Gazette n° Special of 04/05/2023 and in force on publication (Art. 14).

Issued by BNR under the insurance law. It requires a board-approved investment policy, prior approval for mortgages and derivatives, and sets concentration limits by asset class and a 30% cap on investments in other East African Community states. Takes effect on publication in the Official Gazette Special of 29/06/2023; existing investments had one year to align.

Lets banks, deposit-taking microfinance institutions and payment service providers use agents after BNR approval (Arts. 8-10, decision within 30 days). It sets due diligence on agents (Arts. 12-14), security and data integrity requirements (Art. 24), agency agreements covering AML/CFT duties (Arts. 25-27) and sanctions (Art. 46). Published in Official Gazette n° 38 Bis of 25/09/2023.

Lets the CMA impose one or more of 16 sanctions, from financial penalties and public reprimand to licence restriction or revocation and recovery of twice the benefit gained (Art. 7), and written warning, suspension or dismissal of board members and senior managers (Art. 8). Administrative fines run from FRW 500,000 to FRW 5,000,000 per violation by category of institution (Art. 10 and annex). An institution may appeal to the CMA within 14 working days (Art. 11). In force on publication in the Official Gazette Special of 30/03/2023 (Art. 15).

Allows innovative financial products to be tested in a live environment for up to 12 months, with one extension of up to 12 months (Art. 8). Applicants must meet eligibility conditions (Art. 4); the Central Bank calls for applications three times a year (Art. 5-7), and AML/CFT, consumer protection and cybersecurity requirements stay in force (Art. 20). Published in Official Gazette nº 16 bis of 18/04/2022 and in force on publication (Art. 23).

Sets the FIC's responsibilities, including analysing suspicious transaction reports, issuing regulations and guidelines for reporting persons and supervising reporting persons that have no other supervisor (Art. 7), and its powers, including requesting information and setting faults and administrative sanctions for reporting persons it supervises (Art. 8). Published in Official Gazette n° Special of 20/08/2021 and in force on publication (Art. 31). Amended by Law No. 002/2025 of 22/01/2025, which the FIC lists on its laws page.

Covers processing and quality of personal data (Arts. 4-17), data subject rights (Arts. 18-26), the supervisory authority (Arts. 27-28), registration of controllers and processors (Arts. 29-36), breach notification (Arts. 43-45) and cross-border transfers (Arts. 48-49). Published in Official Gazette n° Special of 15/10/2021 as Law N° 058/2021 of 13/10/2021; applies to controllers outside Rwanda that process data of people in Rwanda (Art. 2). The NCSA is the supervisory authority.

Criminalises soliciting, accepting or offering an illegal benefit (Art. 4), influence peddling (Art. 7) and unlawful favours in contracts and services (Art. 16). Public organs, private institutions, civil society and international organisations must put prevention mechanisms in place (Art. 3), and the Ombudsman requests administrative sanctions against the leader of a non-compliant organ. Companies and similar entities convicted of corruption face a fine of seven to ten times the illicit benefit (Art. 18). Published in Official Gazette Special of 20/09/2018; repeals Law N° 23/2003 (Art. 24).

Protects people who disclose wrongdoing in the public interest: disclosures are received in secret under a code (Art. 10), retaliation such as dismissal, suspension or demotion is barred (Art. 11), and victimisation carries three to five years' imprisonment plus a fine (Art. 17). Published in Official Gazette 41 of 10/09/2017, but its offences and penalties provisions take effect only after a related organic law is harmonised with the Constitution (Art. 20). Repeals Law nº 35/2012 (Art. 19). The text names no single supervising authority.