Rwanda (RW)

Licensing, Authorisation & Market Access

Rwanda operates a unified licensing regime under the National Bank of Rwanda (BNR). Regulation N° 74/2023 of 18/09/2023 Governing Payment Services Providers establishes a single PSP licensing regime under Law N° 061/2021. No person may carry on a payment service by way of business unless a licensed PSP. Applicants must be incorporated in Rwanda, maintain a registered office, appoint a Rwandan citizen or resident CEO, and meet initial capital thresholds of RWF 30m-300m across Categories I-IV. The statutory basis is Law N° 061/2021, and Regulation 74/2023 replaces the earlier 2018/2015 regulations. Banks are exempt where BNR-licensed, so the regime spans both bank-PSP and non-bank routes through a single supervisor. AML/CFT and internal-control requirements are embedded directly in the licensing file.

The localisation requirement — a Rwandan-incorporated entity plus a resident CEO — is the analytically decisive feature for any foreign payments operator, as it defines the market-access gate and shapes foreign-fintech entry strategy.

A transition obligation sits alongside the standing regime. Article 60 of Regulation N° 74/2023 required all currently licensed PSPs to apply for licence recategorisation by 18 September 2024, one year from gazette publication, with non-compliance risking licence revocation. This is carried as a historical event: the deadline was presented prospectively as of August 2024, and the outcome and current June 2026 compliance status were not verified this cycle. The transition therefore carries residual risk for incumbent licensees and revocation exposure for any non-compliers, but post-deadline supervisory outcomes such as revocations or extensions remain under-covered in the available source base.

Outlook

The W1a standing position is established and stable. The open item is supervisory follow-through on recategorisation: confirming the post-September-2024 compliance outcome would close the principal gap in this module. No change to the core licensing architecture is indicated this cycle.

Conduct, Safeguarding & Promotions

The operative safeguarding mechanism for non-bank issuers is trust-account segregation. A non-BNR-supervised institution issuing e-money must hold a trust account at a licensed Rwandan commercial bank whose terms prevent the PSP from accessing those funds for non-payment operations, ensuring each customer's funds are always traceable and segregated. This is the customer-fund protection model for Rwandan e-money, and it embeds a bank-partnership dependency: the non-bank PI/EMI layer relies on a licensed commercial bank to hold the ring-fenced funds. E-money business does not constitute deposit-taking under Regulation 54/2022.

On conduct and promotions, BNR has tightened the FX regime. BNR Regulation N° 89/2025 (effective 30 May 2025) expanded the prohibition on pricing goods or services in foreign currency to cover verbal, written, contractual, promotional or digital conduct, with fines of RWF 5m for a first offence rising to RWF 10m, and 50%-100% penalties for unauthorised FX transactions. The current framework is best read as Regulation 89/2025 together with a BNR FX Operations Directive issued 17 September 2025 clarifying exempt categories. That directive was identified via challenger counter-evidence but was not separately registered in the source base this cycle, so the framework is treated as both instruments combined. This conduct constraint touches merchant and PSP marketing in FX terms, and the enforcement penalties are material.

Outlook

The trajectory is tightening. The principal open item is formal registration of the 17 September 2025 FX Operations Directive to confirm the exact perimeter of exempt categories. The safeguarding model is stable and bank-dependent for non-bank issuers.

Stablecoins & Digital Money

The digital-money story is the CBDC, not private stablecoins. BNR completed a five-month CBDC proof-of-concept for the e-Franc Rwandais (e-FRW) from May to 31 October 2025, finding a CBDC technically feasible across online, offline and USSD channels, and as of February 2026 moved to a 12-month pilot with real users and financial service providers. No issuance decision has been taken; the pilot is ongoing, roughly mid-cycle as of June 2026, with no interim progress report found this cycle.

The e-FRW is positioned as a public-money anchor, and no private-stablecoin framework is in force. The multi-channel design — explicitly spanning USSD and offline channels — signals an inclusion focus that is directly relevant to a mobile-money-led market, where reaching feature-phone and offline users is a structural design constraint rather than an afterthought. This is a bank-PSP-facing rail in development.

Outlook

The e-FRW pilot, started February 2026, is expected to conclude around early 2027, when a potential issuance decision for the e-Franc Rwandais may follow. No interim pilot findings have surfaced between the February 2026 launch and June 2026, so the pilot is mid-cycle with no published results. The issuance decision is the single most-watched forward variable in the Rwandan payments environment, and the absence of an interim report is itself the principal information gap.

Payment Corridor Dynamics

The corridor story is the arrival of Africa-owned cross-border rails. Bank of Kigali launched PAPSS in Kigali on 26 February 2025, becoming the first bank in Rwanda to integrate the system, enabling local-currency (RWF/USD) cross-border receipts from member countries within roughly 120 seconds. The count of live PAPSS markets is best reported as around 16 as of mid-2025, with live commercial banks in approximately 12 countries, superseding an earlier and imprecise 11-17 range. No single authoritative Tier-1 count is confirmed, so the figure is adopted at constrained confidence. PAPSS reduces third-currency correspondent dependency: local-currency settlement removes the so-called dollar hurdle for intra-African trade. Domestic settlement runs through RIPPS (RTGS), with the EAC Masterplan and EAPS/REPSS framing regional integration.

A second, earlier-stage development is the Ghana-Rwanda-Zambia corridor. Ghana, Rwanda and Zambia are testing an interoperable cross-border corridor allowing businesses to invoice and settle directly in cedis, Rwandan francs or kwacha, aligned with the EAC Cross-Border Payment System Masterplan and again removing the dollar hurdle. This is a dashboard-tier item at pilot stage, not in production, but it points to a multilateral local-currency model that would reduce FX friction for cross-border SME trade.

Outlook

The corridor trajectory is opening. PAPSS is live and expanding; the Ghana-Rwanda-Zambia corridor remains a pilot to watch for progression into production. The principal data gap is a single authoritative count of live PAPSS markets.

Product Innovation & Market Development

The product-innovation runway is the national interoperability programme. Rwanda unveiled RNDPS 2.0 — developed with MINICT, MINECOFIN, BNR, RISA, AFR, RSwitch, AfricaNenda and Mojaloop — plus eKash P2M (person-to-merchant) payments by RSwitch at IFF2025, enhancing interoperability across banks, MNOs, MFIs and SACCOs. BNR runs a regulatory sandbox with 17 admitted fintechs. GTBank moved fully onto eKash, exiting bilateral systems and receiving an RSwitch Certificate of Interoperability Compliance in April 2026, a concrete signal that the interoperability mandate is being operationalised at the institutional level.

The Open Banking Framework is in consultation, the National Fintech Strategy 2024-2029 targets $200m of investment and 7,500 jobs, and a Ghana licence-passporting MoU supports cross-border fintech access. Together, Mojaloop-based national instant-payment interoperability plus the open-banking consultation define the product-innovation runway for Rwandan fintechs.

Outlook

The trajectory is expanding. The BNR Open Banking Framework, currently in consultation, is expected to move toward adoption during 2026, which would be the next material product-access development. Continued institutional migration onto eKash — following GTBank — is the operational indicator to track.

AML/CFT & Financial Crime (Sentinel-fed)

This module is sourced from the Sentinel feed and is carried here as provenance only; original illicit-finance analysis is routed to the Financial Intelligence Monitor (FIM).

Per the Sentinel feed, the Rwanda Financial Intelligence Centre (FIC) — established by Law N° 74/2019 and governed by Law N° 045/2021, amended January 2025 — receives and analyses suspicious transaction reports relating to money laundering, terrorist financing and proliferation financing, and disseminates to competent authorities. Rwanda is an ESAAMLG member whose 2nd-round mutual evaluation report (on-site June-July 2023, adopted September 2023) found significant reform progress but implementation hampered by capacity gaps, with STRs coming mostly from banks and money/value transfer services and negligible reporting from NBFIs and DNFBPs. Rwanda was not on FATF grey or black lists as of mid-2025. The January 2025 FIC Law amendment expanded monitoring powers and reporting obligations.

The payments-relevant read is the bank-versus-non-bank supervision gap: negligible NBFI and DNFBP STR reporting flags an AML coverage risk in the rapidly growing mobile-money and fintech layer. This is the cross-monitor hand-off to FIM, which warrants original illicit-finance analysis of that gap.

Outlook

The trajectory is strengthening on paper — the January 2025 amendment expanded powers — but the implementation depth gap persists as the residual structural risk. Detailed illicit-finance assessment sits with FIM; this module tracks only the regulatory-architecture signal.

Operational Resilience & Critical Infrastructure

Operational resilience is codified. Regulation N° 50/2022 of 17/06/2022 on Cyber Security in Regulated Institutions requires resilient ICT with protection, detection, response and recovery programmes that are regularly tested, an IT Steering Committee drawing in IT, HR, legal and business functions, multi-factor authentication and business-continuity planning, with post-incident debriefs. It repealed the 2018 cyber regulation and applied a one-year compliance window from gazette publication.

The regulation sits within the National Cybersecurity Strategy 2024-2029, led by the National Cyber Security Authority. It is not a DORA-equivalent but is functionally analogous as a resilience layer, providing an operational-resilience compliance baseline for all BNR-regulated payments participants, bank and non-bank alike.

Outlook

The regime is established and stable. No new resilience instrument is indicated this cycle; the watch-item is implementation depth across smaller participants such as MFIs and SACCOs rather than any change to the rule itself.

Scheme & Network Compliance

Scheme compliance in Rwanda runs through the national switch. RSwitch is PCI DSS and PTS certified and operates the national payment gateway accepting international cards (Visa, Mastercard, UPI), Smartcash cards and mobile transactions, and runs the eKash interoperable instant-payments switch. PCI DSS is mandated for entities handling cardholder data and enforced by Visa and Mastercard via acquirers; chargeback and dispute windows follow Visa Core Rules and Mastercard Rules.

No domestic interchange-cap regulation surfaced this cycle, so scheme rules plus PCI form the operative compliance layer rather than any local pricing intervention. QR acceptance via eKash P2M and USSD are increasingly supplementing card rails. The national switch's certification status underpins card acceptance and interoperability across the whole market, which makes RSwitch a single point of both reliance and resilience for the card layer.

Outlook

The scheme-compliance position is stable. The operative layer remains Visa and Mastercard rules plus PCI DSS enforced through acquirers; the structural drift is toward QR and mobile-money rails supplementing cards rather than any change in scheme governance.

Industry Structure & Commercial

The Rwandan retail market is mobile-money-led and concentrated on both layers. MTN Mobile Money and Airtel Money together hold over 70% of the digital-payments market, with mobile-money accounts reaching around 9.8m users (roughly 76% of adults) by March 2025. On the bank side, around 76% of bank assets sit with five large commercial banks — Bank of Kigali, BPR, I&M, COGEBANQUE and Equity — with Bank of Kigali alone holding 30%-plus of assets among 16 licensed banks. The telecom layer underneath is itself an MTN-Airtel duopoly holding roughly 88% of SIMs.

These concentration figures carry a caveat: the 76% top-five and Bank of Kigali 30%-plus figures are 2025 Trade.gov estimates without a specific month, carried forward and not re-verified in June 2026. Emerging-market structural data of this kind is dated, and private-company and 2026 supervisory data are under-indexed in the available source base. With that caveat, high concentration on both the mobile-money and bank layers shapes competitive dynamics and partnership leverage for any new entrant: scale and distribution sit with a small number of incumbents.

Outlook

The structure is stable and concentrated. The watch-item is refreshed supervisory or private-company data to confirm whether the 2025 concentration baseline still holds in 2026; no structural consolidation event surfaced this cycle.

Legal & Litigation

Enforcement in Rwandan payments is administrative and supervisory, not litigation-driven. BNR may withdraw or suspend a PSP licence where the provider has not commenced within 12 months, ceased the service for over one month, obtained the licence through incorrect statements, endangers financial-system stability, or is insolvent. AML/CFT administrative sanctions run under Regulation N° 72/2023 (in force 27 June 2023) across a seven-category institution scheme, with appeals to BNR within seven working days and BNR's decision final. No landmark private payments litigation surfaced this cycle.

The enforcement risk channel is therefore administrative revocation and fines rather than civil litigation. FX-conduct penalties run up to 100% of transacted amounts under Regulation 89/2025, and the criminalisation of unlicensed activity raises entry risk for any unauthorised operator. The practical implication is that legal risk in this market is concentrated at the supervisor, not in the courts.

Outlook

The litigation picture is stable, with administrative enforcement dominant and no landmark private case in view. The watch-item is supervisory enforcement intensity — revocations and AML sanctions — rather than any emerging litigation trend.

Merchant Acquiring & Risk

Merchant acceptance is dominated by mobile money. Mobile-money merchant accounts (MTN MoMo Pay, Airtel Money Merchant) are onboarded via registered phone number and QR/USSD with fees of roughly 0.5%-1.5%, while card acquiring (Visa/Mastercard, 3D Secure) is concentrated in urban, tourism and diaspora segments, and aggregators such as Flutterwave and DPO Group provide multi-rail acceptance. The MTN merchant network reached around 578k by Q3 2025. Prominent fraud vectors are SIM-swap and card-testing fraud, mitigated via OTP and transaction monitoring; chargeback and dispute mechanics follow scheme rules passed through acquirers.

The acceptance economics favour QR and mobile money over card acquiring, and the fraud focus on SIM-swap is directly relevant to merchant onboarding and risk controls. This module is under-indexed in the source base: merchant-acquiring operational detail — chargeback volumes, acquirer stress, MCC-level risk — is thinly sourced through aggregator and vendor tiers, consistent with the methodology's flag that emerging-market merchant operations are systematically under-covered.

Outlook

The acquiring landscape is stable, with mobile-money merchant accounts the dominant rail. The principal limitation is evidentiary rather than substantive: deeper merchant-ops data would sharpen the risk picture, but no structural shift in acceptance is indicated.

Consumer Protection & APP Fraud

Consumer protection is anchored in Law N° 017/2021 and BNR Regulation N° 55/2022 (in force 7 November 2022), requiring financial service providers to embed consumer-protection responsibilities at board level, run quarterly consumer-satisfaction surveys, monitor advertising and handle consumer data, with BNR empowered to impose administrative sanctions. Grievance redress is operationalised nationally via the BNR/Proto AI chatbot INTUMWA across 591-plus institutions in Kinyarwanda, English and French, with 100% digital intake, registry verification and supervisory dashboard routing.

Recourse runs through the BNR complaints framework rather than a UK-style PSR reimbursement model: no dedicated mandatory APP-fraud reimbursement scheme surfaced this cycle. The board-level obligations, quarterly surveys and advertising monitoring, combined with centralised grievance routing, shape conduct expectations for PSPs.

Outlook

The consumer-protection framework is established. The notable absence — a mandatory APP-fraud reimbursement scheme — is the structural gap relative to advanced markets and the item to watch if Rwanda moves to formalise fraud-loss allocation. No change to the framework is indicated this cycle.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank-versus-non-bank access asymmetry: settlement and correspondent access run through licensed banks, leaving non-bank participants dependent on bank partnerships. All Rwandan commercial banks maintain international correspondent banking relationships in major financial centres, with cross-border retail remittance served by Western Union and MoneyGram via partner banks (Bank of Kigali, BPR/Atlas Mara, KCB, I&M, Ecobank). Domestic settlement runs through RIPPS (RTGS) and the eKash/RNDPS switch under BNR financial-market-infrastructure oversight, PFMI-assessed.

The sector is well-capitalised, with an industry capital-adequacy ratio of around 21% against a 12.5% minimum (a 2025 baseline figure), and no acute de-risking crisis surfaced, though banks remain conservative. PAPSS adds an Africa-owned rail that reduces correspondent dependency. The net read is that stable correspondent relationships, strong capitalisation and PAPSS access together reduce settlement-access risk, while bank conservatism constrains the available product range — and the bank-routed nature of access keeps non-bank participants reliant on bank intermediation.

Outlook

The settlement-access position is stable. No acute de-risking is in view, and PAPSS is incrementally reducing third-currency dependency. The watch-item is whether the bank-versus-non-bank access asymmetry eases as interoperability and PAPSS mature, or whether bank conservatism continues to gate non-bank reach.

Commercial Intelligence (M&A, Investment & Product)

Two discrete commercial events anchor this module.

First, on 25 February 2025 the Bank of Ghana and the National Bank of Rwanda signed Africa's first fintech licence-passporting agreement, allowing startups licensed in either country to operate in both markets without restarting authorisation. The event is announced and its value is not publicly disclosed. As Africa's first fintech passport, it meaningfully lowers cross-border market-access friction and sets a precedent for regional regulatory interoperability.

Second, remittance fintech NALA received a Payment Service Provider licence from the National Bank of Rwanda, enabling direct integration with Rwanda's banks and mobile-money operators for international payments (event date approximately November 2023). This is a completed market-entry event; its value is not publicly disclosed, and the November 2023 date sits at the edge of the trailing-twelve-month window for a June 2026 run. A foreign remittance fintech securing direct Rwanda licensing signals corridor-access expansion into the market.

Outlook

Commercial activity is regulatory- and ecosystem-led rather than headline-M&A-driven; no major M&A surfaced this cycle. The licence-passporting precedent and continued foreign-fintech licensing are the threads to track for further market-access events.