Account opening and KYC software for banks, microfinance institutions and SACCOs in Rwanda.
Capture the basics the FIC's 2026 Regulations list for opening an account, from the customer, beneficial owners and signatories to the expected use of the account, on forms your team builds, and work each application through a staff review. BAOS is the account-opening workflow that sits beside your identity-verification provider, which runs the national ID checks BNR's digital account opening Directive describes, and your core banking system, which opens the account. Deploy it from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata.
- 8basic requirements for opening an account in the FIC's Regulations N° 002/FIC/2026 (Art. 11)
- 17 Dec 2025BNR signed Directive No 43/2025 of 08/12/2025 on digital account opening
- 25% or moreof shares or voting rights makes a beneficial owner of a company or partnership (Registrar General Instructions 001/2023/RG)
- 10 yearsminimum to keep account-opening records after the relationship ends (Law N° 001/2025 Art. 21)
What Rwanda's rules ask for at account opening, and where each one lands.
Law N° 001/2025 and the FIC's Regulations N° 002/FIC/2026 set customer due diligence for every reporting person, including banks, microfinance institutions, SACCOs and e-money issuers, and BNR's Directive No 43/2025 adds rules for accounts opened online. Paraphrased below, with what BAOS records and what stays with your other systems.
| The rule | Recorded in BAOS | Outside BAOS |
|---|---|---|
| To open an account, the FIC lists eight basic requirements: customer and beneficial-owner identification and the identity number; the signatories; the customer's full professional and personal address; the legal form, status and structure of a legal person or arrangement; its country of establishment; proof of incorporation and the registered office; the nature and purpose of the customer's activity; and the expected use of the account. An institution may add its own requirements.FIC Regulations N° 002/FIC/2026 Art. 11(1)-(2) | Your team builds the form from the shared sections and adds a question for anything missing, such as the expected use of the account. Your own extra requirements go on the same form. | Checking what the customer declares against registers and ID systems. |
| Identify each individual (full names, phone and email, date and place of birth, nationality, occupation or employer, residence and domicile address) and verify the name against an official ID number or other unique identifier in an unexpired official document that bears the customer's photograph. Verification may finish after onboarding only as soon as reasonably practicable, where that is essential not to interrupt business, and with the risks managed.Law N° 001/2025 Arts 13(1)(f), 13(2) and 16 | Identity, ID document details, employment and addresses on your published form, with a document slot for the ID that staff verify in the review. | Checking the ID against NIDA or another independent source, through your identity-verification provider. |
| Digital account opening meets the same KYC standards as branch onboarding, including real-time identity verification using national ID systems, and biometric authentication and document scanning where applicable. The applicant reads and consents to the terms, sees the Key Facts Statement before the account opens and confirms a summary before submitting.BNR Directive No 43/2025 of 08/12/2025 (signed 17 December 2025) Arts 4(1)-(2), 5(1)-(3), 5(5) and 5(7) | The online application in the customer portal, with your terms and consent on the form as required confirmations, and the staff review on the same record. | Real-time national ID checks, biometrics and document scanning: your identity-verification provider. The Key Facts Statement: your product documents. |
| For a legal person or arrangement, understand its business and its ownership and control structure, and verify its name, legal form and proof of existence, the powers that bind it, its senior managers, and its registered office and principal place of business.Law N° 001/2025 Art. 14(1) | Fifteen entity types, the entity profile, directors and shareholders, and a document slot for each item on your checklist, such as the Registrar General's certificate of incorporation or certificate of partnership registration. | The RDB register of companies and shareholder lists, which any person may inspect for a fee (Companies Law N° 007/2021 Art. 278). |
| Identify the beneficial owners. For companies and partnerships, that is any natural person holding 25% or more of the shares (or capital contribution) or voting rights, directly or indirectly. FIC guidance lets the customer certify its owners on a form and lists public registries among the ways to verify them.Registrar General Instructions N° 001/2023/RG Art. 1; FIC Guidelines N° 002/2025 pp. 15-16 | Beneficial owners recorded with their ID and shareholding on the business application. BAOS does not calculate ownership. | Applying the 25% test and verifying the owners. Bank access to RDB's central BO register is unsettled: the Companies Law opens it to competent authorities (Art. 116 ter), while the AML Law says BO information must be publicly available (Art. 35). |
| Verify that anyone acting for the customer is authorised, identify and verify that person, and identify each signatory.Law N° 001/2025 Art. 13(1)(b); FIC Regulations N° 002/FIC/2026 Arts 11(1)(b) and 12 | Signatories with their own ID records and documents, the operating mandate from eight, and a document slot for the proof of authority. | ID checks on each signatory and representative. |
| A tontine (ikimina) registered with its Sector gains legal personality and may open and run an account in any financial institution in its own name, with signatories its members elect under its rules of procedure. A cooperative receives a provisional certificate of registration, then a certificate of definitive legal personality, from RCA.Ministerial Order N° 001/24/10/TC Arts 16, 17 and 23; Cooperatives Law N° 057/2024 Art. 69 | The group form records the member register, elected officials and the meeting resolution; SACCO and registered group are among the fifteen entity types. | Sector registration of the tontine, and RCA's register of cooperatives. |
| Keep customer due diligence records for at least ten years after the business relationship ends, and keep the signed Key Facts Statement for at least ten years in the customer's file.Law N° 001/2025 Art. 21; FIC Regulations N° 002/FIC/2026 Art. 43; BNR Regulations N° 90/2025 of 18/06/2026 Art. 12 | Each application stays on the form version it was filled on, with its documents and an audit record of each workflow action: user, role, time and IP address. | Your retention schedule and the Key Facts Statement file. BAOS has no automated retention schedule. |
Summaries of Creodata's Rwanda fact sheet, checked against primary sources on 9 October 2026. Not legal advice.
NIDA, the single digital ID and the TIN.
The National Identification Agency (NIDA) issues Rwanda's national ID. Law N° 029/2023 created the single digital identity (SDID) system and repealed the 2008 ID law, while operations under the old system stay valid for no more than four years from the Law's publication on 15 June 2023 (Art. 38(2)). NIDA began SDID enrolment in November 2025, capturing fingerprints, facial images and iris scans. Under the new Law, presenting an SDID card is not sufficient proof of identity until it is authenticated (Art. 21(1)).
What the law asks of banks, microfinance institutions and SACCOs is verification: the customer's name against an official ID number in an unexpired photo document (Law N° 001/2025 Art. 13(2)). That Law does not name NIDA. A check through NIDA's database, or through independent sources, is required for e-money issuers (BNR Regulation N° 54/2022 Art. 9), and BNR's Directive No 43/2025 says digital account opening includes real-time verification using national ID systems (Art. 5(5)). We found no rule that requires a NIDA check when an account is opened in a branch. Customers onboarded remotely are identified and verified in the same way as those met in person (FIC Regulations N° 002/FIC/2026 Art. 13).
Institutions that rely on SDID data integrate with NIDA under a separate agreement on systems integration and authentication (Law N° 029/2023 Art. 30), and request a person's data only for a specific purpose, with that person's prior consent (Art. 21(3)); we found no published fees or API terms. BAOS does not connect to NIDA: the check comes from your identity-verification provider or your own NIDA integration, and BAOS holds the ID details, the documents and the staff review. On tax, the Registrar General assigns the taxpayer identification number used with the Rwanda Revenue Authority (RRA) (Tax Procedures Law N° 020/2023 Art. 12), and we found no provision in that Law that makes a TIN a condition for opening an account. Company and cooperative beneficial-ownership registers do record each owner's TIN, so add a TIN field where your policy asks for one.
Rwanda forms: built in the form builder, in English or Swahili.
No Rwanda template ships with BAOS; the country templates are Kenyan and Tanzanian. Your team builds Rwanda's forms in the no-code form builder from the shared section library, nearly forty prebuilt sections in nine areas, for business applicants (the business form is published by default) and for personal, group and joint applicants, whose forms ship as drafts to publish. Rwandan ID types are not in the option sets either, so your team adds the national ID and any other documents your policy accepts. Of the format checks that ship, passport and phone numbers apply in Rwanda; the others are for Kenyan and Tanzanian numbers, and none checks a Rwandan ID number.
Rwanda has four official languages: Kinyarwanda, English and French under the Constitution (Art. 8), and Kiswahili under Organic Law N° 02/2017. BNR requires written financial information in a language the consumer is conversant with or has chosen among the official languages, in electronic tools too (Regulation N° 55/2022 Art. 18), and the Key Facts Statement in the official language the consumer chooses (Regulations N° 90/2025 Art. 6); Directive No 43/2025's schedule of fines includes failing the language requirements for the platform and digital documents (Appendix I). BAOS form text can be English and Swahili only. French and Kinyarwanda form text are not supported, and the staff interface is in English, so plan how you will serve customers who choose French or Kinyarwanda.
Where account-opening data may be stored under Rwandan rules.
Rwanda's data protection law, supervised by the National Cyber Security Authority (NCSA), and BNR's outsourcing regulation together decide where onboarding data may be stored and when a cloud service needs approval. BAOS can run in either place:
Azure Marketplace
In your own Azure subscription, in the Azure region you choose. Azure has no region in East Africa; the nearest are South Africa North and South Africa West.
On-premises
In your own data centre in Rwanda, installed and supported by Creodata. Choose it where your rules keep data or systems in the country.
Personal data is stored in Rwanda unless NCSA authorises otherwise
Data controllers and processors store personal data in Rwanda. Storage outside Rwanda is permitted only with a valid registration certificate from NCSA that authorises it; NCSA's Data Protection and Privacy Office publishes an application for this authorisation.
Law N° 058/2021 Art. 50
Transfers abroad need a lawful ground and a contract
Personal data may be shared or transferred outside Rwanda with NCSA's authorisation after proof of appropriate safeguards, with the data subject's consent, or on another ground the Law lists, under a written contract with the recipient. NCSA publishes standard contractual clauses and may prohibit or suspend transfers.
Law N° 058/2021 Arts 48-49
Controllers and processors register with NCSA
Anyone who intends to be a data controller or processor registers with NCSA, and the application names the country to which it intends to transfer personal data. Changes are notified within fifteen working days.
Law N° 058/2021 Arts 29-32
BNR treats cloud services as outsourcing
BNR considers cloud services a form of outsourcing, and outsourcing material activities needs its prior approval; the institution stays accountable and should retain the encryption key. Outsourcing outside Rwanda calls for a country-risk assessment, known disaster-recovery locations and no jurisdiction where BNR's prompt access to information may be impeded. We found no BNR rule that primary data stays in Rwanda; the data protection storage rule above still applies.
BNR Regulation N° 49/2022 Arts 18, 20 and 21
Frequently asked questions.
Does BAOS check IDs with NIDA?
No. BAOS does not connect to NIDA or to any other register. It records each person's ID details and documents, and staff record their review. Where you need a NIDA check, it comes from your identity-verification provider or your own integration: e-money issuers must verify the ID or passport number through NIDA's database or independent sources (BNR Regulation N° 54/2022 Art. 9), and BNR's Directive No 43/2025 says digital account opening includes real-time verification using national ID systems (Art. 5(5)). Relying parties integrate under a separate agreement with NIDA (Law N° 029/2023 Art. 30).
What does BNR's Directive No 43/2025 mean for opening accounts online?
The Directive (No 43/2025 of 08/12/2025, signed 17 December 2025) applies to financial service providers that open accounts through online or electronic channels, and took effect on signature (Arts 2(c), 3(a) and 33). KYC follows the standards of branch onboarding (Art. 5(5)); the applicant consents to the terms and sees the Key Facts Statement before opening (Arts 4 and 5); a summary is confirmed before submission (Art. 5(7)); and the customer is told the account type, number and name afterwards (Art. 6). The platform design goes to BNR for information at public rollout (Art. 4(7)), and an institution stays fully liable for a FinTech partner (Art. 29(4)). BAOS gives you the online application and the staff review. National ID, biometric and document-scanning checks come from your identity-verification provider, and BAOS has no SMS or USSD channel.
Do customers need a TIN to open an account in Rwanda?
We found no provision in the Tax Procedures Law (Law N° 020/2023) that makes a TIN a condition for opening an account. The Registrar General assigns TINs (Art. 12), company and cooperative beneficial-ownership registers record each owner's TIN, and the FIC's beneficial-ownership guidance lists a tax identification number among the basic information on an individual customer. CRS due diligence and self-certification apply to reportable accounts (Law N° 021/2023 Arts 5 and 11). In BAOS a TIN is a field your team adds where your policy asks for one, with no Rwandan format check, and a FATCA/CRS self-certification template ships.
Can our onboarding data stay in Rwanda?
BAOS has two deployment options: from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in Rwanda or elsewhere in East Africa (the nearest are South Africa North and South Africa West), and Rwanda's data protection law says personal data is stored in Rwanda unless NCSA has issued a certificate authorising storage outside it (Law N° 058/2021 Art. 50). Where your data must stay in Rwanda, choose the on-premises deployment. The Enterprise AI features run on Azure AI services in East US 2 or Sweden Central, so that processing is not in Rwanda. BNR also treats cloud services as outsourcing, and material outsourcing needs its prior approval (Regulation N° 49/2022 Arts 20-21).
Can SACCOs and microfinance institutions in Rwanda use BAOS?
Yes. BNR licenses deposit-taking microfinance companies and cooperatives, SACCOs among them, under Law N° 072/2021, and both are reporting persons under the AML Law, so the same due-diligence rules apply. We found no member-KYC rule written for SACCOs alone. RCA registers cooperatives, but the FIC does not list it as an AML supervisor. In BAOS, SACCO is one of the fifteen entity types, and a SACCO can run personal, business and group forms for its members, with the group form recording the member register, the elected officials and the meeting resolution.
Can an ikimina (tontine) open a bank account?
Yes, once registered. Under the Ministerial Order of 21 August 2024, a tontine of at least five people registers with the administration of its Sector, free of charge, receives a registration certificate and gains legal personality. It may then open and run an account in any financial institution in its own name, with signatories its members elect under its rules of procedure (Ministerial Order N° 001/24/10/TC Arts 6, 13, 16, 17 and 23). We found no rule that sets a bank's document list for group accounts. In BAOS your team sets the group form's documents, such as the Sector certificate, the rules of procedure and the list of representatives, and records the officials with their IDs.
See BAOS set up for Rwanda.
Bring your account types, your document checklists and your hosting rules to a live demo, and see an application go from the applicant to your reviewers.