Rwanda FIC goAML Reporting: A Practical Guide for Banks

Rwanda runs the youngest financial intelligence regime in the East African Community — and one of the fastest-moving. The Financial Intelligence Centre (FIC) only became operational in December 2020, yet by mid-2026 Rwanda has rebuilt its core AML statute twice (Law N° 028/2023, then Law N° 001/2025), stood up a UNODC goAML portal for electronic reporting, published a national risk assessment, expanded the FIC's powers by a January 2025 amendment, brought a virtual-asset law into force, and seen the FIC admitted to the Egmont Group. The direction of travel is unmistakable: Kigali is building an international financial centre, and the compliance infrastructure is being professionalised to match.

For compliance officers, the operational picture is exacting in ways that differ from neighbouring markets: suspicious transaction reports are due within 24 hours under the FIC's 2026 Regulations, cash transaction reporting runs on sector-specific thresholds rather than a single national figure, and the 2024 ESAAMLG mutual evaluation — which found that banks filed 84% of STRs and that STR volumes actually fell 28% between 2022 and 2023 — tells every reporting entity exactly where supervisory attention is heading: more reports, better reports, and from more sectors than just the banks.

This guide is a practical reference for Rwandan reporting persons: the legal framework, the FIC's goAML portal, CTR and STR requirements, identity and registry data, penalties, and how to run Rwanda's rules on the same platform you use across the region.

For step-by-step detail on Rwanda, see our guides to FIC goAML registration, suspicious transaction reports, Law N° 001/2025 and choosing AML compliance software.

For regional context, see our companion guides: Kenya FRC goAML Reporting: Complete Guide, Uganda FIA goAML Reporting, Tanzania FIU goAML Reporting, and Zambia FIC goAML Compliance.

Rwanda's AML Legal Framework

From Police Reporting to an Independent FIC

Rwanda's financial intelligence function has been rebuilt from the ground up in five years. Before 2020, the predecessor Financial Investigation Unit sat under the Ministry of Internal Security, and reporting entities filed suspicious transaction reports to the Police and to the National Bank of Rwanda in parallel — an arrangement the ESAAMLG assessors politely described as having "created confusion."

Law N° 74/2019 of 29/01/2020 established the Financial Intelligence Centre as an independent body under the ministry responsible for finance. The FIC became operational in December 2020. Its governing statute today is Law N° 045/2021, amended by Law N° 002/2025 of 22 January 2025 — an amendment that expanded the Centre's monitoring and information-gathering powers, heightened reporting-entity obligations, and streamlined international cooperation.

One structural fact worth knowing: the FIC is now a member of the Egmont Group of Financial Intelligence Units. It was admitted at the 32nd Egmont Plenary in Baku (5–10 July 2026), together with the FIUs of the DRC, Eswatini and Madagascar. Membership raises expectations on the quality of the financial intelligence the FIC receives and exchanges — which is to say, on the quality of your institution's reports.

Law N° 001/2025 — the Current AML Statute

Rwanda's substantive AML/CFT/CPF law is Law N° 001/2025 of 22/01/2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. It came into force on publication in the Official Gazette on 22 January 2025 and repealed Law N° 028/2023 of 19/05/2023, so procedures that still cite the 2023 law's article numbers are out of date. The obligations that drive day-to-day compliance sit in two articles:

Article 32 — suspicious transaction reporting: a reporting person must "promptly" report suspicion or reasonable grounds for suspicion, covering attempted transactions, with no monetary threshold.
Article 33 — cash transaction and wire transfer reporting at or above thresholds, with the thresholds, modalities, and time limits delegated to FIC regulations.

The detail lives in FIC regulations — principally Regulations N° 002/FIC/2026 of 22/06/2026 on AML/CFT/CPF, which repealed the 2023 regulations (N° 002/FIC/2023), and Regulations N° 001/FIC/2026 of the same date determining faults and sanctions — plus the FIC's STR guidance of July 2023 and the National Bank of Rwanda's Regulation N° 63/2023 of 25/04/2023, which arms the central bank with administrative sanctions, up to and including licence withdrawal, for the institutions it supervises.

The 2024 Mutual Evaluation

Rwanda's second-round ESAAMLG mutual evaluation (on-site mid-2023, report published July 2024) includes detailed statistics on suspicious transaction reporting.

The reporting-specific findings should shape every Rwandan compliance programme:

The FIC received 789 STRs in 2021/22 and 2022/23 together, and STR volumes fell 28% between 2022 and 2023
Banks dominate filing with 84% of those STRs and money or value transfer providers filed 15%, so every other reporting person, the entire DNFBP sector included, accounted for about 1%

The FIC and the goAML Portal

How FIC Rwanda Uses goAML

The FIC operates a UNODC goAML portal as its electronic reporting platform, with production at goweb.fic.gov.rw. At the time of the 2023 mutual evaluation on-site, STRs were still being filed by encrypted email and goAML had been purchased but was not yet operational; the portal has since gone live, and by early 2026 the FIC was running goAML reporting training for professional sectors. If your institution's procedures still describe emailing STRs, they are out of date: the FIC's 2023 STR guidance listed email as one channel, but its portal notice now says STRs and SARs that require manual data entry must be filed in the production environment. Reports under the targeted financial sanctions rules are the exception — the FIC's sanctions guidance and public notices still direct them to report@fic.gov.rw.

The portal accepts STR, SAR, CTR, and WTR (wire transfer report) types. Registration as a reporting organisation requires a copy of your regulator licence, the certificate of domestic company registration, and the compliance officer's appointment letter. Institutions building automated XML submission pipelines for CTR and WTR volumes are required to prove their files in the goAML testing environment before being authorised for production — a sensible gate that rewards getting schema validation right the first time.

Who Must Report

Article 8 of Law N° 001/2025 defines the reporting persons:

Financial institutions — which, through Bank of Rwanda licensing, covers commercial banks, microfinance institutions and SACCOs, e-money issuers and mobile money channels, money remitters, and forex bureaus
Advocates, notaries, professional bailiffs, and other independent legal professionals when handling real estate transactions, client funds, or company formation and management
Auditors, accountants, and tax advisors
Real estate agents
Dealers in precious metals and precious stones
Persons in the business of distributing money
Casinos and gaming halls of national lotteries
Trust and company service providers
Virtual assets service providers (listed in the 2025 law)

Non-profit organisations carry separate obligations under Article 45, and a Ministerial Order can extend the list. Note that virtual asset service providers are reporting persons: Article 8 of Law N° 001/2025 lists them, and the virtual-asset business law in force since May 2026 (see below) adds Capital Market Authority licensing on top.

Differences from Kenya FRC in Practice

Sector-specific CTR thresholds. Unlike Kenya's single national threshold, Rwanda sets different cash-reporting lines per sector (see next section). Threshold logic must be configured per reporting-entity type, not per country alone.
A 24-hour STR deadline. The FIC's 2026 Regulations set the STR window at 24 hours from the occurrence of the transaction or activity — tighter than Kenya, in line with Tanzania, and far tighter than the multi-day windows many regional procedures assume.
A recent portal. Rwanda's goAML portal went live only after mid-2023, when the mutual evaluation found goAML not yet operational; registration documentation requirements and the test-before-production gate apply, and entities migrating from email-era procedures need to re-paper their processes.

CTR Thresholds: Sector-Specific by Design

The Threshold Table

Rwanda's cash transaction reporting thresholds are set by FIC regulation rather than by the law itself: Article 33 of Law N° 001/2025 delegates them to the FIC. Under Article 41 of Regulations N° 002/FIC/2026, reporting persons report cash transactions or value transfers at these lines:

Reporting context	Threshold (FRW)
Occasional customer (except where sender and recipient are banks or other financial institutions)	10,000,000 or more
Casinos	3,000,000 or more
Dealers in precious metals and stones	15,000,000 or more
Transactions involving a wire transfer	1,000,000 or more

An important caution for financial institutions: the 2026 Regulations set the FRW 10,000,000 line "for an occasional customer" and apply the FRW 1,000,000 wire line to "the transaction or transfer provided for in Paragraph (1)", and the English, French and Kinyarwanda texts read the same way. The 2023 regulations they replaced (N° 002/FIC/2023) had a separate line requiring financial institutions to report cash of FRW 10,000,000 or more for every customer, and a wire line covering every wire transfer of FRW 1,000,000 or more; the 2022 regulation before them set FRW 50 million for financial institutions, FRW 1 million for electronic money and FRW 60 million for motor vehicle dealers. None of those lines appears in the 2026 text, yet the FIC's own FAQ and bank reporting templates still describe the 2023 rule, and its reporting-template folder still includes an e-money CTR template. Institutions should ask the FIC whether account holders' cash of FRW 10 million or more, and their wires of FRW 1 million or more, are still reportable, and configure monitoring to the stricter reading until that is confirmed in writing. This is precisely the kind of moving regulatory detail that a maintained country-profile configuration exists to absorb.

Reports are due within two working days from the date of the transaction or transfer (Article 42), and the aggregation rule is explicit: linked transactions that individually sit below the threshold but together exceed it are reportable as one. Separately, cross-border movements of cash or bearer negotiable instruments of FRW 10,000,000 and above must be declared at the border under the FIC's cross-border declaration regime.

What This Means Operationally

Sector-specific thresholds make Rwanda the clearest case in the region for configuration-driven monitoring. A bank alone works with two reporting lines — FRW 10 million for occasional customers and FRW 1 million where a wire transfer is involved — plus the open question on account holders' cash and wires, and a casino or a dealer in precious metals in the same group faces a different line again. Hard-coding "the Rwanda threshold" into detection logic is a design error; the threshold is a function of the reporting entity's sector, the client relationship type, and the transaction channel.

STR Filing Requirements

Prompt Means 24 Hours

Article 32 of Law N° 001/2025 requires reports to be made "promptly," covers attempted transactions, and applies regardless of amount, and it leaves procedures and time limits to the FIC. Regulations N° 002/FIC/2026 set the limit: a suspicious transaction or activity is reported "within 24 hours from its occurrence" (Article 39(3)). Note the start point. The 2023 regulations said "promptly … within 24 hours" without saying when the clock starts, and many procedures assume it starts when suspicion is formed; the 2026 text counts from the occurrence of the transaction or activity, which is the stricter reading. Build your alert-escalation-narrative-approval workflow to that clock, and do not wait for the end of an internal investigation — Rwanda's penalty provisions (below) make slippage expensive.

Typologies the FIC Expects You to Detect

Rwanda's 2024 National ML/TF Risk Assessment, covering July 2019 to June 2024, finds the highest exposure in banking, e-money issuers, and forex bureaus, with proceeds laundered predominantly through banking and real estate. Monitoring rules in a Rwandan deployment should be calibrated to:

Real estate — a sector the FIC supervises directly; watch cash-intensive purchases and layering through property
Gold and 3TG minerals trade — trade-based laundering and beneficial-ownership opacity
E-money and remittance corridors — rated more susceptible to terrorism financing; structuring below the FRW 1 million wire-transfer threshold is the obvious pattern
Cross-border cash — the FRW 10 million declaration line and the porous-border realities of the region
Casinos — the FRW 3 million threshold exists because the sector is on the FIC's radar

Close the DNFBP Gap Before the FIC Closes It for You

The mutual evaluation's starkest numbers — 84% of STRs from banks and 15% from money or value transfer providers, leaving about 1% for everyone else, DNFBPs included — guarantee where supervision goes next, and the FIC's 2026 goAML training for 189 notaries, court bailiffs and lawyers confirms it. Law firms, accountants, real estate agencies, and dealers in precious metals that have never filed are not invisible; they are conspicuous. For these entities, the practical blocker is usually tooling: no transaction monitoring, no XML capability, no case workflow. That is a solvable problem, and solving it before the first FIC inspection is dramatically cheaper than after.

Identity, Registry, and Data Requirements

Customer and Entity Identifiers

For individuals, Law N° 001/2025 requires identity to be verified using an "official personal identification number or other unique identifier contained in an unexpired official document that bears a photograph of the customer", with other documentary evidence specified by the supervisory authority (Article 13(2)). The list of identification documents in the 2022 regulation (passport, identity card, driving licence and, for entities, the certificate of incorporation) has been superseded by Regulations N° 002/FIC/2026, so check your onboarding standard against the current text.

For legal entities, the basic account-opening requirements in Regulations N° 002/FIC/2026 include the identity number, the legal form, status and structure, and "a proof of incorporation and address of the registered office" (Article 11(1)). Capture those details once at onboarding, validate them, and carry them into every goAML entity record.

Penalties Snapshot

Obligation	Provision	Exposure
Failure to submit an STR, tipping off, destroying records, filing knowingly false documents	Law 001/2025, Art. 63	2–5 years' imprisonment + fine of FRW 2–5 million (applies to board members, senior managers, and employees personally); legal persons: fine of FRW 10–20 million
Breaching the preventive duties, including registration (Art. 9), records (Art. 21), STRs (Art. 32) and cash and wire reports (Art. 33)	Law 001/2025, Art. 66	1–3 years' imprisonment or a fine of FRW 1–5 million; legal persons: fine of FRW 5–20 million
Money laundering	Art. 56	10–15 years + fine of 3–5× the value laundered
Terrorist financing	Art. 57	20–25 years + fine of 3–5×; life imprisonment if death results
Administrative faults, including registration failures, late or missing reports and unreported cash transactions	FIC Regulations N° 001/FIC/2026 of 22/06/2026 (faults and sanctions), Arts 3, 6 and 25	For reporting persons "under the supervision of the Centre": FRW 8–10 million for late registration; FRW 2–4 million per late, missing, incomplete or erroneous report (FRW 5–7 million where the aim was to hide a fault); 10% of an unreported cash transaction. The 2022 regulation that previously covered failure to register has been repealed
Supervisory breaches (BNR-regulated institutions)	BNR Regulation N° 63/2023 of 25/04/2023	Administrative sanctions from a written warning up to licence revocation; for failing to maintain a system for detecting and reporting suspicious activity, or to send STRs and CTRs to the FIC, a fine of FRW 10 million for a commercial bank, down to FRW 250,000 for the smallest category

The Article 63 design is worth a board briefing: STR failures attach criminal liability to the individuals involved — board members and senior managers included — and the 2025 law adds a fine of FRW 10–20 million for the institution itself. Article 66 also covers the reporting duties, at lower penalties, and the Law does not say how the two articles apply when both could cover the same failure.

What Changed in 2023–2026: A Compliance Officer's Shortlist

April 2023 — BNR Regulation N° 63/2023 sets administrative sanctions for AML/CFT failures by BNR-licensed institutions.
May 2023 — Law N° 028/2023 replaces the 2019 AML law.
June–July 2023 — FIC Regulations N° 002/FIC/2023, the cross-border declaration regulation and FIC STR guidance land in quick succession.
July 2024 — ESAAMLG publishes Rwanda's second-round mutual evaluation.
January 2025 — Law N° 001/2025 replaces Law N° 028/2023 as the AML/CFT/CPF statute, renumbering the key articles (STRs are now Article 32, threshold reports Article 33) and listing virtual assets service providers as reporting persons; Law N° 002/2025 expands the FIC's powers.
April 2025 — the 2024 National Risk Assessment, covering July 2019 to June 2024, is published.
October 2025 — FIC Guidelines N° 002/2025 on transparency and beneficial ownership.
May 2026 — Rwanda's virtual asset business law (Law N° 023/2026 of 25/05/2026) is gazetted on 28 May and in force: Capital Market Authority licensing for VASPs; fines for legal entities of FRW 70–100 million for providing virtual asset services without a licence and FRW 120–150 million for issuing virtual assets without approval; unauthorised crypto-ATMs, mixers, mining facilities and virtual-asset payments restricted. VASPs are already reporting persons under Law N° 001/2025, so those operating in Rwanda need AML reporting capability now.
June 2026 — FIC Regulations N° 002/FIC/2026 (AML/CFT/CPF) and N° 001/FIC/2026 (faults and sanctions) replace the 2023 regulations: the STR deadline becomes 24 hours from occurrence, and the threshold table is rewritten.
July 2026 — the FIC is admitted to the Egmont Group at the 32nd Egmont Plenary in Baku.

Deploying an AML Platform for Rwanda

Country Profile Configuration, Not Custom Code

Rwanda is the strongest argument in the region for configuration-driven compliance tooling. Whatever platform you use, a correct Rwanda country profile holds: sector-specific CTR thresholds (with the FI-threshold question tracked as a configuration item pending FIC confirmation), the two-working-day CTR window and linked-transaction aggregation, the 24-hour STR clock counted from occurrence, the goAML report-type set (STR, SAR, CTR, WTR), and the goweb.fic.gov.rw submission target with its test-before-production gate. When the FIC updates a threshold or issues new guidelines — as it has done repeatedly since 2023 — the profile updates; your deployment doesn't change.

Multi-Country East African Operations

A banking group operating across Rwanda, Kenya, Uganda, and Tanzania faces four FIU portals, four threshold regimes in three currencies plus sector-specific lines, and STR clocks ranging from 24 hours to multiple days. One platform with per-country profiles gives the regional compliance function a single view of filing performance and SLA risk, while each country team files against its own FIU's rules.

Creodata's goAML platform includes country profiles for Rwanda (FIC), Kenya (FRC), Uganda (FIA), Tanzania (FIU), and Zambia (FIC) that administrators can configure: it holds each FIU's thresholds and validation rules as a country profile rather than custom code.

Compliance Checklist for Rwandan Reporting Persons

1. FIC Registration: Your institution is registered on the FIC's goAML portal with the required documents (regulator licence, company registration certificate, compliance officer appointment letter), and your compliance officer details are current.

2. Sector-Correct Thresholds: Your CTR detection applies the right threshold for your sector and client type — and you have asked the FIC in writing whether account holders' cash of FRW 10 million or more, and wires of FRW 1 million or more, are still reportable under the 2026 Regulations (its FAQ and bank templates still describe the 2023 rule), with monitoring set to the stricter reading meanwhile.

3. Aggregation: Linked sub-threshold transactions are aggregated and reported when they jointly exceed the threshold, across branches and channels.

4. Two-Working-Day CTR Window: CTRs and WTRs reach the FIC within two working days, with acknowledgements retained.

5. 24-Hour STR Process: Your alert-to-filing workflow can deliver an STR within 24 hours of the transaction or activity occurring, the clock in Article 39(3) of the 2026 Regulations — including attempted transactions, with no minimum amount — and the timestamps prove it.

6. Test-Environment Discipline: Automated XML pipelines are validated in the goAML test environment, and schema validation runs before every production submission.

7. Identity Data: ID or passport numbers from unexpired official photo documents for individuals (Law Article 13(2)), and proof of incorporation and registered-office details for entities (Regulations Article 11(1)) — captured at onboarding, validated, and flowing into goAML XML without re-keying.

8. Typology Coverage: Rules calibrated to Rwanda's risk profile: real estate, gold and minerals trade, e-money structuring, cross-border cash, and casino patterns.

9. Beneficial Ownership: Entity records meet the FIC's 2025 transparency and beneficial ownership guidelines, and ownership data appears in STR entity records.

10. Audit Trail: Every report has an immutable record of who detected, reviewed, approved, and submitted it — the evidence base for FIC inspections and the personal-liability protection your approvers will want under Article 63.

Deploy Rwanda-Ready goAML Reporting with Creodata

Rwanda built a modern FIU in five years and is now supervising with intent — while its rulebook keeps moving: a new AML law in 2023 and another in 2025, new regulations and a virtual-asset regime in 2026, and Egmont Group membership the same year. Compliance processes built on email-era assumptions and a single hard-coded threshold will not survive contact with that pace of change.

Creodata's goAML Reporting Platform generates schema-valid goAML XML from core-banking data, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. See goAML reporting software for Rwanda, and AML compliance software in Rwanda for the monitoring and case management behind each report.

See it on your own report types — request a demo.