KYC Requirements for Account Opening in Rwanda: Law 001/2025 and the FIC Regulations 2026

Short answer: Rwanda's KYC rules for opening an account come from Law N° 001/2025 (Articles 11 to 20) and the FIC's Regulations N° 002/FIC/2026, whose Article 11 lists eight basic requirements for account opening. A bank must verify the customer's name against an official identification number in an unexpired photo document. BNR's 2023 AML/CFT Guidelines add a written customer identification programme. Records are kept for at least ten years.

This guide is for compliance, operations and product teams at banks, microfinance institutions, SACCOs and e-money issuers in Rwanda. This is a practical guide, not legal advice; confirm requirements with your supervisor (BNR, FIC) or adviser. Checked against primary sources on 9 October 2026.

Creodata makes BAOS, account opening software for banks in Rwanda; near the end we say plainly where it fits. Rwanda's laws are adopted in Kinyarwanda, so our quotations are from the English version.

Which rules govern KYC at account opening in Rwanda?

BNR's Guidelines (§5.1) ask each institution for a written, board-approved customer identification programme with account-opening procedures.

We found no separate BNR KYC regulation for banks, and no instrument yet specifying the documentary evidence the Law leaves to the supervisory authority (Art. 13(2)–(3)). Ask BNR which documents it expects.

When does customer due diligence apply?

Article 12 triggers CDD when you establish a business relationship; suspect money laundering, terrorist financing or proliferation financing, whatever the amount; doubt earlier identification data; or carry out occasional transactions or wires at or above the FIC's thresholds.

The core measures (Art. 13(1)) are to identify and verify the customer, anyone acting for them and the beneficial owner, understand the purpose of the relationship, and keep monitoring it. Anonymous or fictitious-name accounts are banned (Art. 11).

What must you collect from an individual customer?

Article 13(1)(f) lists the data:

• full legal and any other names, including marital name, former legal name or alias;
• telephone number and email address;
• date and place of birth, and nationality;
• occupation, public position held or name of employer;
• residence and domicile address;
• "any other information as may be required by the supervisory authority".

Article 13(2) sets the verification rule for the name:

"A reporting person must verify the information set out in Paragraph (1)(f)(i) of this Article using official personal identification number or other unique identifier contained in an unexpired official document that bears a photograph of the customer …"

Under the 2023 digital ID law, an SDID card is not sufficient proof of identity "until proper authentication is established" (Law N° 029/2023 Art. 21(1)), and the old ID system stays valid for up to four years from 15 June 2023, to around mid-June 2027 by our count (Art. 38(2)). See our guide to digital account opening and NIDA checks in Rwanda.

A TIN is not on the Law's list, and the Tax Procedures Law (Law N° 020/2023) has no provision making one a condition for opening an account.

What does Article 11 of the 2026 Regulations require?

Article 11 is the only article we found in Rwandan law headed "account opening":

Art. 11(2) lets you add your own requirements. For items (d) to (f), see our guide to corporate account opening requirements in Rwanda.

Signatories and people acting for the customer

You must "verify that a person purporting to act on behalf of the customer is so authorised, and identify and verify the identity of that person" (Law Art. 13(1)(b); R26 Art. 12), and identify every signatory (R26 Art. 11(1)(b)). The FIC's beneficial ownership guidelines say a person acting for a legal person must present evidence of the power to act and an official ID; if they cannot, you may refuse the relationship. See authorised signatories and signing mandates.

Must verification be complete before the account opens?

Not always, but the texts read differently:

• Law Art. 16(1) allows verification "before or during" the relationship, or completion afterwards, provided it happens as soon as reasonably practicable, is essential not to interrupt the normal conduct of business, and the risks are effectively managed. Art. 16(2) requires risk procedures for use of the relationship before verification.
• R26 Art. 7(1) says basic CDD applies "before entering into a business relationship", while Art. 8(1)(a) lists later verification as a simplified measure.
• BNR's Guidelines (§5.7) give non-face-to-face business as an example where later completion may be permissible, and say institutions should limit the number, type or value of transactions before verification.

The Law prevails. If your journey opens accounts before every check is back, base it on Art. 16, write its conditions into policy, limit the account until verification completes, and record the completion date.

Non-face-to-face customers are verified "in the same manner" as face-to-face ones, with measures against "fraud by single or multiple false applications" (R26 Art. 13). For digital channels, BNR's Directive says KYC "includes real-time identity verification using national ID systems" (Art. 5(5)); we found no equivalent rule for branch onboarding.

Is there simplified due diligence or a "light KYC" account?

Simplified due diligence exists, but it does not remove identification. The measures in R26 Art. 8(1) defer verification, reduce updating and monitoring, or infer purpose from the transaction type, and SDD is "not acceptable whenever there is a suspicion" (Art. 8(2)).

We found no value-tiered bank or microfinance account that waives ID. E-money accounts are tiered by customer type (individual, legal person, basic agent, merchant), not by balance, and the issuer must verify the ID or passport number "through the National Identification Agency's database or through independent sources" (BNR Regulation N° 54/2022 Arts 8–9).

PEPs and sanctions screening at onboarding

• Foreign PEPs are "always" high-risk (R26 Art. 10(2)): senior management approval, source of wealth and funds, and enhanced ongoing monitoring (Law Art. 22(2)).
• Domestic and international-organisation PEPs get these measures when the relationship is higher risk (Art. 22(3)).
• The rules extend to family members and close associates (Art. 22(5)).
• We found no Minister's Order defining PEPs (Art. 22(6)), so the definitions come from Law Art. 2(bb) and R26 Art. 2(l).

BNR's Guidelines require checks of new, existing and potential customers against the national list and the UN Consolidated List; on a confirmed match, reject the potential customer and file a suspicious transaction report. See PEP and sanctions screening at account opening and Creodata's AML software for Rwanda.

What if you cannot complete CDD?

Law Art. 19: do not open the account, start the relationship or perform the transaction; end any existing relationship; and consider a suspicious transaction report to the FIC. See suspicious transaction reports in Rwanda, FIC goAML registration and Rwanda's AML Law N° 001/2025 explained.

Ibimina, groups and joint accounts

Ibimina (tontines) are regulated by Ministerial Order N° 001/24/10/TC of 21/08/2024. A tontine needs at least five persons and registers, free, with the administration of its Sector (Arts 6 and 13). It receives a registration certificate and "automatically acquires legal personality" (Arts 16–17). Article 23 of the English translation says:

"(1) A tontine may open and run an account in any financial institution in its names. (2) Signatories to the account of a tontine are elected by members in accordance with the tontine's rules of procedure."

We found no bank-side document list for tontine or group accounts. The general rules apply: identify and verify each signatory and anyone acting for the group, and use the Sector certificate as proof of existence. We found no joint-account rule either; the signatory rule is the starting point. See BAOS for group accounts and our joint account requirements guide.

SACCOs and microfinance institutions

BNR licenses and supervises deposit-taking microfinance companies and cooperatives (SACCOs) under Law N° 072/2021. Both are reporting persons under the AML Law, covered by BNR's Guidelines and its sanctions Regulation N° 63/2023. The Rwanda Cooperative Agency registers cooperatives but is not listed by the FIC as an AML supervisor. Financial service cooperatives may serve non-members only if they comply with the AML laws (Law N° 057/2024 Art. 165(1)).

We found no member-KYC rule addressed to SACCOs, so the Law and the Regulations apply as they do to banks. For the member journeys, see BAOS's SACCO member onboarding page, written for Kenya's rules.

The Key Facts Statement comes before the account

Regulations N° 90/2025 of 18/06/2026 (gazetted 26 June 2026) require an updated Key Facts Statement "before opening an account" (Art. 9(b)), in the official language the consumer chooses (Art. 6). The signed copy is kept for at least ten years (Art. 12).

The fine for opening an account without a KFS is FRW 500,000 "for each financial service consumer's file" at a bank (less for microfinance institutions and e-money issuers). That is a disclosure fine, not a KYC fine; CDD failures fall under BNR Regulation N° 63/2023, at FRW 3,000,000 per violation for a commercial bank.

How long must account-opening records be kept?

At least ten years: CDD records and account files from the end of the relationship, and transaction records from completion (Law Art. 21; R26 Art. 43). That includes sanctions screening records and records of business refused because CDD was incomplete.

Where BAOS fits

Whatever system you use, each Rwandan file should show the Art. 11 items; how, when and by whom identity was verified, including any completion under Law Art. 16; each signatory's authority; the PEP determination, screening result and approvals; the KFS; and where the data is stored.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. Business, personal, group and joint applicants each have their own form; the business form is published by default and the others ship as drafts. No Rwanda template, ID-type list or Rwandan format check ships: your team builds the forms in the no-code builder from the shared sections and adds Rwanda's ID types to the option sets. Format checks ship for the KRA PIN, Kenyan ID, Tanzanian TIN, passport and phone numbers only. Forms can carry English and Swahili, two of Rwanda's four official languages, but not Kinyarwanda or French; the staff interface is English.

BAOS records the KYC data on your form, beneficial owners with their ID and shareholding, and the PEP and FATCA declarations made in the application, and lists every person who needs screening once each. Reviewers claim an application, verify documents and approve or reject it, then record the account number once the core banking system opens the account. Every workflow action is recorded with who, what role, when and from which address.

BAOS does not check IDs with NIDA, run liveness or face match, screen against lists, rate risk or book accounts: those stay with your verification provider, screening tool and core banking system. It has no multi-level account approval, so senior management approval for PEPs and EDD stays in your existing process, and its audit record is not append-only.

You can run BAOS from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Rwanda's data protection law stores personal data in Rwanda unless NCSA has certified storage outside (Law N° 058/2021 Art. 50), and Azure has no region in East Africa; the nearest are South Africa North and South Africa West. Where your data must stay in Rwanda, choose the on-premises deployment. The Enterprise AI features run on Azure AI services in East US 2 or Sweden Central, so AI processing is not in Rwanda. See BAOS in Rwanda for the rules mapped to the workflow, or the BAOS product page for plans.

Frequently asked questions

What are the KYC requirements for opening a bank account in Rwanda?

Law N° 001/2025 Arts 11 to 20 and R26 Arts 7 to 17: verify an individual's name against an official ID number in an unexpired photo document, and cover the eight Art. 11 basics, from beneficial owners and signatories to the expected use of the account.

Can a small account be opened without ID under simplified due diligence?

We found no such exemption. SDD reduces updating and monitoring or defers verification; it does not remove identification, and never applies where there is suspicion (R26 Art. 8).

Is a TIN required to open an account in Rwanda?

No provision in the Tax Procedures Law (Law N° 020/2023) makes a TIN a condition for opening an account.

Can an ikimina open a bank account?

Yes. A tontine registered with its Sector may open and run an account in any financial institution in its own name, with signatories elected under its rules (Ministerial Order N° 001/24/10/TC Art. 23).

How long must KYC records be kept in Rwanda?

At least ten years after the relationship ends for CDD records, and ten years from completion for transactions (Law Art. 21; R26 Art. 43).