Rwanda's Anti-Money Laundering Law N° 001/2025 Explained: Reporting Persons, Duties, the FIC and Penalties (2026)
A plain-English guide to Rwanda's Law N° 001/2025 on money laundering, terrorist financing and proliferation financing, with the FIC's 2026 Regulations: reporting persons, due diligence, reporting, targeted financial sanctions, offences and penalties, who enforces, and what changed from the 2023 law.
Short answer: Law N° 001/2025 of 22 January 2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction is Rwanda's AML/CFT law. It replaced Law N° 028/2023 and took effect on publication. It:
- lists the reporting persons, now including virtual asset service providers;
- requires them to register with the Financial Intelligence Centre (FIC), assess their risks, apply customer due diligence and keep records for at least 10 years;
- requires suspicious transaction reports, which the FIC's 2026 Regulations set at 24 hours, and cash and wire transfer reports above the FIC's thresholds;
- punishes money laundering with 10 to 15 years' imprisonment and a fine of three to five times the value laundered.
The FIC's Regulations N° 002/FIC/2026 and N° 001/FIC/2026 of 22 June 2026 fill in the detail and set its administrative fines.
This guide is for compliance officers, boards and legal teams at Rwandan banks, microfinance institutions, insurers, payment and remittance providers, capital-market firms, virtual asset service providers, casinos, real estate agents, dealers in precious metals and stones, lawyers, notaries, bailiffs, accountants and tax advisers. It is a practical guide, not legal advice: the Law, the Regulations and the FIC's guidance are the authoritative texts. The Law "was drafted in English, considered, and adopted in Ikinyarwanda", so our quotations are from its English version.
The law in force
| Instrument | What it does |
|---|---|
| Law N° 001/2025 of 22/01/2025 | The core law, in force on its publication in the Official Gazette on 22 January 2025 |
| Law N° 045/2021 governing the FIC, amended by Law N° 002/2025 of 22/01/2025 | The FIC's functions and powers |
| Regulations N° 002/FIC/2026 of 22/06/2026 | Registration, risk management, due diligence, wire transfers, reporting and records |
| Regulations N° 001/FIC/2026 of 22/06/2026 | Faults and administrative sanctions for reporting persons under the FIC's supervision |
| Regulations N° 001/FIC/2025 of 15/01/2025 | Targeted financial sanctions |
| Prime Minister's Order N° 001/03 of 22/01/2025 | The National Counter-Terrorism Committee, which runs the domestic sanctions list |
| Regulations N° 001/FIC/2023 of 26/06/2023 | Declaring cross-border cash and bearer negotiable instruments of FRW 10 million or more |
| Law N° 023/2026 of 25/05/2026 | Regulating virtual asset business, with the Capital Market Authority as regulator |
| BNR Regulation N° 63/2023 and CMA Regulations N° 001/CMA/2023 | The National Bank of Rwanda's and the Capital Market Authority's AML/CFT administrative sanctions |
How it got here. Law N° 75/2019 of 29 January 2020 was replaced by Law N° 028/2023 of 19 May 2023, which Law N° 001/2025 repealed in turn. One article of the 2020 law survives: Article 27, which established the national Coordination Council that coordinates the fight against money laundering, terrorist financing and proliferation financing. A Presidential Order sets the Council's membership.
The Law at a glance
| Chapter | Subject | Articles |
|---|---|---|
| I | General provisions, including definitions | 1–7 |
| II | Preventive measures | 8–44 |
| III | Specific requirements for non-profit organisations | 45–50 |
| IV | International cooperation | 51–55 |
| V | Offences and penalties | 56–66 |
| VI | Miscellaneous provisions | 67–73 |
| VII | Final provisions | 74–77 |
Who the Law covers
Article 8 lists the reporting persons:
- financial institutions;
- advocates, notaries, professional bailiffs and other independent legal professionals, when they represent or assist a client outside legal proceedings, for example in buying and selling real estate, managing client money or accounts, or creating and managing companies;
- auditors, accountants and tax advisers;
- real estate agents;
- dealers in precious metals and precious stones;
- people and companies in the business of distributing money;
- casinos and national lottery gaming halls;
- trust and company service providers;
- virtual asset service providers.
An Order of the Minister in charge of finance may add others. When we checked on 1 October 2026, the FIC's compliance page listed about 3,500 reporting persons in an undated table: 408 financial institutions and 3,128 designated non-financial businesses and professions.
Key definitions (Article 2):
| Term | Meaning |
|---|---|
| Immediately | "within 24 hours at the latest" |
| Financial institution | Anyone who conducts, as a business and for or on behalf of a customer, activities such as accepting deposits, money or value transfer services, issuing and managing means of payment, underwriting long-term insurance, and money and currency changing |
| Beneficial owner | "a natural person who ultimately owns or controls a customer or the natural person on whose behalf a transaction is being conducted", including a natural person with "ultimate effective control" over a legal person or arrangement |
| Politically exposed person | An individual who is or has been entrusted with prominent public functions by Rwanda, a foreign country or an international organisation, "including his or her family members and close associates" |
| Virtual asset service provider | A business that exchanges virtual assets for fiat currencies or for other virtual assets, transfers or safekeeps virtual assets, or provides financial services for an issuer's offer and sale of a virtual asset |
What reporting persons must do
| Duty | What the law requires |
|---|---|
| Registration (Article 9(a)) | Register with the FIC; a new reporting person within 30 days after getting its certificate of incorporation (Regulations, Article 4). See our FIC goAML registration guide |
| Risk assessment (Article 9(b)) | Identify, assess, document and update money laundering, terrorist financing and proliferation financing risks by customer, country, product, service, transaction and delivery channel. The Regulations require an institutional risk assessment at least once a year and whenever the business changes significantly, informed by the national and sectoral risk assessments (Article 5) |
| New products and technologies (Article 25) | Assess the risks before launching new products, business practices, delivery mechanisms or technologies |
| Customer due diligence (Articles 12 and 13) | When establishing a relationship, on suspicion, when earlier data is doubtful, and for occasional transactions and wire transfers at or above the FIC's thresholds: identify and verify the customer, anyone acting for them and the beneficial owner, understand the purpose of the relationship, and monitor it |
| Beneficial ownership (Article 14) | A three-step test: the natural person with a controlling ownership interest, then control through other means, then the senior managing official. The FIC's 2025 guidelines treat more than 25% of the shares, or at least 25% of the voting rights, as controlling |
| Enhanced and simplified due diligence (Article 18) | Enhanced measures where risks are higher; simplified measures only where they are lower, and never when there is a suspicion (Regulations, Article 8) |
| Politically exposed persons (Article 22) | Systems to identify them. Foreign PEPs need senior management approval, measures to establish the source of wealth and funds, and enhanced ongoing monitoring, and the Regulations treat them as "always" high risk. Domestic and international-organisation PEPs get the same measures when the relationship is higher risk. The rules extend to family members and close associates |
| Higher-risk countries (Article 31) | Enhanced due diligence for countries the FATF calls out; the FIC's Director General may set countermeasures |
| Correspondent banking (Article 23) | Due diligence on the respondent and senior management approval; no relationships with shell banks |
| Reliance on third parties (Article 28) | Allowed for parts of due diligence if the third party can supply copies within 24 hours on request; the reporting person stays responsible |
| Wire transfers (Article 27; Regulations, Articles 21 to 30) | Above a FRW 1 million de minimis threshold, cross-border transfers carry the originator's and beneficiary's names and account numbers, the originator's address and date of birth, and identifiers for legal persons. A non-compliant transfer is not executed, and the receiving institution checks for missing information |
| Compliance programme (Article 29) | Internal controls, a compliance officer at management level, staff screening on hiring, ongoing training and an independent audit. The Regulations require the audit at least once a year (Article 33) and an annual compliance report to the supervisor, copied to the FIC (Article 44) |
| Records (Article 21) | At least 10 years after the transaction, the end of the relationship or the occasional transaction, including sanctions screening records, business refused for incomplete due diligence, and training records |
Reporting to the FIC
Suspicious transactions. A reporting person that suspects funds or other assets are the proceeds of crime or linked to terrorist financing "must promptly submit a report setting forth the suspicion to the Centre", including attempted transactions and "regardless of the amount" (Article 32). The FIC's Regulations set the limit at "within 24 hours from its occurrence" (Article 39). See our guide to STRs in Rwanda.
Cash and wire transfers. Article 33 leaves the thresholds to the FIC. Regulations N° 002/FIC/2026 (Article 41) set these lines:
| Line | Threshold |
|---|---|
| A cash transaction or value transfer "for an occasional customer", except where the sender and recipient are banks or other financial institutions | FRW 10 million or more |
| A transaction made in a casino | FRW 3 million or more |
| A transaction done by a dealer in precious metals and precious stones | FRW 15 million or more |
| A transaction or transfer "provided for in Paragraph (1)" that involves a wire transfer | FRW 1 million or more |
Linked transactions count together, and the report goes on the FIC's template "within two working days from the date of the transaction or transfer" (Article 42).
Check with the FIC. The 2026 text has no separate line for financial institutions' account holders. The repealed 2023 Regulations did: financial institutions reported cash transactions of FRW 10 million or more for every customer, and every reporting person reported wire transfers of FRW 1 million or more. The FIC's FAQ, its bank reporting templates and a public notice of 25 July 2023 still describe that rule, so confirm the current expectation with the FIC (gosupport@fic.gov.rw).
Targeted financial sanctions
- Who designates. The National Counter-Terrorism Committee, chaired by the Minister in charge of internal security with the FIC's Director General as rapporteur, is responsible for Rwanda's domestic list of terrorists and terrorist financiers. Once it approves a designation, the Ministry of Justice publishes the list, and the prohibitions apply immediately.
- What reporting persons do. Under the FIC's Regulations N° 001/FIC/2025, they screen names and addresses against the UN consolidated list and the domestic list, including before any new business relationship. On a match, they freeze the funds "without prior notice to the designated person" and report a suspicious transaction or activity; where no funds are found, they still report to the FIC "without delay".
- The 24-hour clock. The 2026 Regulations require implementation within the FIC's timeline "in order to comply with 24 hours which start from the time of designation" (Article 36). The FIC's January 2026 guidance on the "without delay" principle sets the stages: screen all customers within 5 hours, report a nil result within 2 hours of screening, and on a match freeze and report within 6 hours of finishing the screening.
- The lists in practice. On 14 October 2025 the Committee designated 25 individuals for involvement in terrorism or terrorist financing. Between March and September 2026 the FIC issued at least 12 public notices on targeted financial sanctions, and its guidance sends sanctions reports to report@fic.gov.rw.
Non-profit organisations
Chapter III requires non-profit organisations to file annual financial statements with detailed breakdowns of income and expenditure, to have controls that account for all funds, to verify the identity of significant donors and to keep transaction records for 10 years. An FIC infographic names the Rwanda Governance Board as their supervisor.
Offences and penalties
| Offence | Penalty |
|---|---|
| Money laundering (Article 56) | 10 to 15 years' imprisonment and a fine of three to five times the value laundered |
| Terrorist financing (Article 57) | 20 to 25 years and a fine of three to five times the value; life imprisonment if it results in death. The offence is committed even if no terrorist act occurs |
| Financing the proliferation of weapons of mass destruction (Article 58) | 20 to 25 years and a fine of five to ten times the value of the financing |
| Legal persons (Article 62) | A fine of 10 to 20 times the value laundered or financed, with possible dissolution, permanent closure and publication of the court decision |
| Failing to submit an STR, tipping off, or frustrating the competent authority (Article 63) | 2 to 5 years and a fine of FRW 2 million to FRW 5 million; legal persons FRW 10 million to FRW 20 million |
| Failing to comply with the preventive duties: registration and risk assessment, customer due diligence, internal controls, records and reports, the tipping-off prohibition, and the requirements for non-profit organisations (Article 66) | 1 to 3 years or a fine of FRW 1 million to FRW 5 million; legal persons FRW 5 million to FRW 20 million |
| Dealing in a designated person's assets, or making assets available to them (Articles 59 and 60) | 3 to 5 years and a fine of FRW 3 million to FRW 5 million |
| Arms dealing with a designated person (Article 61) | 10 to 15 years and a fine of FRW 5 million to FRW 10 million |
The Law does not say how Articles 63 and 66 apply when both could cover the same failure. The penalties for the money laundering, terrorist financing, proliferation financing and sanctions offences in Articles 56 to 61 are doubled for organised crime or a repeat offence (Article 65). Money laundering, terrorist financing and proliferation financing are not subject to statutory limitation (Article 69), a suspect need not first be convicted of the predicate offence to be prosecuted for money laundering (Article 71), and courts can confiscate criminal property without a criminal conviction (Article 68).
Who enforces
The FIC. The FIC became operational in December 2020 and is supervised by the ministry in charge of finance. Under the AML Law it has "the sole authority to carry out financial intelligence" (Article 7) and may freeze or seize funds, other assets or a transaction for up to 30 days while it verifies them (Article 6). Its own law, as amended in 2025, lets it access "electronic data and other information banked in the servers of reporting persons", issue regulations and guidelines, set administrative sanctions for reporting persons under its supervision, and regulate those with no recognised supervisor. The Egmont Group of financial intelligence units admitted the FIC as a member in July 2026.
Supervisory authorities. They license and supervise reporting persons on a risk basis, inspect them, compel information, and impose sanctions up to withdrawing a licence (Articles 43 and 44). The FIC's FAQ names nine: the National Bank of Rwanda (BNR), the Capital Market Authority (CMA), the Rwanda Revenue Authority, the Rwanda Mining Board, the Rwanda Development Board, the Ministry of Justice, the Institute of Certified Public Accountants of Rwanda, the Rwanda Bar Association and the FIC itself, which supervises real estate agents directly.
Administrative sanctions:
- The FIC. Regulations N° 001/FIC/2026 apply to reporting persons under its supervision. Examples: FRW 8 million to FRW 10 million for late registration; FRW 2 million to FRW 4 million per late, missing, incomplete or erroneous report; 10% of a cash transaction that should have been reported; FRW 10 million to FRW 12 million for failing to screen against the sanctions lists or to freeze without delay. Failing to carry out a remediation plan adds 50% to the initial fine, and appeals go to the FIC's Director General within seven working days.
- The BNR. Regulation N° 63/2023 covers banks and other BNR-licensed institutions, with sanctions from a written warning to revocation of the licence and fines set by category of institution.
- The CMA. Regulations N° 001/CMA/2023 cover capital-market licensees.
What changed
From Law N° 028/2023 to Law N° 001/2025:
- professional bailiffs and virtual asset service providers became reporting persons;
- new definitions, including "immediately" as 24 hours at the latest, and an article on virtual assets;
- breaches of the preventive duties became criminal offences under Article 66, where the 2023 law treated them as administrative misconduct;
- the STR and tipping-off offence added frustrating the competent authority, and a fine of FRW 10 million to FRW 20 million for legal persons;
- PEP relationships now need senior management approval and checks on the source of wealth as well as funds;
- the 10-year record period also runs from the end of the relationship or the occasional transaction.
The prison terms and fines for money laundering, terrorist financing and proliferation financing did not change.
From the 2023 to the 2026 FIC Regulations:
- an annual institutional risk assessment;
- a more senior compliance officer with Board access, and 24 hours to report a change;
- no registration window for existing reporting persons;
- longer lists of enhanced due diligence, PEP and high-risk-country measures;
- a wire-transfer chapter with a FRW 1 million de minimis threshold and checks on the payee;
- the STR clock now runs "from its occurrence";
- restructured threshold lines, with no separate line for financial institutions;
- an annual independent audit and an annual compliance report;
- a 24-hour deadline for targeted financial sanctions.
From the 2022 to the 2026 sanctions regulations: a FRW 8 million minimum for late registration; FRW 2 million to FRW 4 million per report instead of FRW 3 million to FRW 5 million; a cash-reporting fine of 10% of the whole transaction rather than of the amount above the threshold; and new faults for sanctions screening, freezing and late reporting of a match.
Rwanda and the FATF
Rwanda was not on the FATF's increased-monitoring or call-for-action lists after the June 2026 plenary, and we found no FATF statement listing it between 2010 and 2026. ESAAMLG published its second-round mutual evaluation of Rwanda in July 2024.
What this means for your systems
| Duty | What a system has to do |
|---|---|
| Risk assessment | Hold a documented institutional assessment, refreshed at least once a year and informed by the national and sectoral assessments |
| Due diligence and PEPs | Capture the identity data the Law lists and the beneficial owners, rate foreign PEPs as high risk, and apply the occasional-transaction triggers: FRW 10 million, FRW 1 million for wire transfers, FRW 3 million in casinos, FRW 15 million for dealers in precious metals and stones, and every real estate transaction |
| Sanctions screening | Rescreen every customer within hours of a UN or domestic list change, screen before onboarding, and log every result |
| Monitoring and STRs | Raise alerts close to real time, and file within 24 hours |
| Threshold reports | Aggregate linked transactions, and file within two working days |
| Wire transfers | Check originator and beneficiary information, and match payee names to accounts |
| Records | Keep 10 years of records good enough to reconstruct each transaction, including screening results and decisions on whether to report |
Frequently asked questions
What is the current money laundering law in Rwanda?
Law N° 001/2025 of 22 January 2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. It repealed Law N° 028/2023, and the FIC's Regulations N° 002/FIC/2026 and N° 001/FIC/2026 of 22 June 2026 implement it.
Who is a reporting person in Rwanda?
Anyone listed in Article 8 of the Law: financial institutions; advocates, notaries, bailiffs and other legal professionals for specified client work; auditors, accountants and tax advisers; real estate agents; dealers in precious metals and stones; money distribution businesses; casinos and national lottery gaming halls; trust and company service providers; and virtual asset service providers.
What is the penalty for money laundering in Rwanda?
10 to 15 years' imprisonment and a fine of three to five times the value laundered. A legal person faces a fine of 10 to 20 times the value, and possible dissolution. Penalties are doubled for organised crime or a repeat offence, and money laundering is not subject to statutory limitation.
How long must records be kept in Rwanda?
At least 10 years after the transaction, the end of the business relationship or the occasional transaction (Article 21).
Who supervises AML compliance in Rwanda?
Each reporting person's supervisory authority, such as the National Bank of Rwanda for banks, microfinance institutions, insurers and payment service providers, or the Capital Market Authority for capital-market firms. The FIC receives reports, issues regulations and supervises real estate agents and other reporting persons with no recognised supervisor.
See how Creodata's AML compliance software in Rwanda maps each duty to a module: book a demo.
More guides for Rwanda
- Rwanda FIC goAML Reporting: A Practical Guide for Banks
- FIC goAML Registration in Rwanda: Step by Step for Reporting Persons (2026)
- Suspicious Transaction Reports in Rwanda: The 24-Hour Rule, goAML Filing and Penalties (2026)
- AML Compliance Software in Rwanda: A Buyer's Guide for Banks, Microfinance, Payment Firms and DNFBPs (2026)
