Anti-money-laundering and sanctions compliance: Law N° 001/2025 and the Financial Intelligence Centre, who is a reporting person, registration and the compliance officer, customer due diligence thresholds, suspicious and cash transaction reports, beneficial ownership, targeted financial sanctions and freezing within 24 hours, cross-border cash, penalties and Rwanda's standing with the FATF

The framework and the authorities

Rwanda's anti-money-laundering (AML) regime was rebuilt in 2025 and 2026. The statute is Law N° 001/2025 of 22/01/2025 on the prevention and punishment of money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction (the AML Law), which repealed Law N° 028/2023 of 19/05/2023 (Article 75). The Financial Intelligence Centre (FIC) operates under Law N° 045/2021 of 18/08/2021 governing the Financial Intelligence Centre, as amended by Law N° 002/2024 published on 22 January 2025. Three FIC instruments carry the detail: Regulations N° 002/FIC/2026 of 22/06/2026 relating to anti-money laundering, combating the financing of terrorism and proliferation (the FIC Regulations), which repealed Regulation N° 002/FIC/2023; Regulations N° 001/FIC/2026 of 22/06/2026 determining faults and sanctions; and Regulations N° 001/FIC/2025 of 15/01/2025 relating to targeted financial sanctions. Cross-border cash is governed by Regulation N° 001/FIC/2023 of 26/06/2023.

The FIC receives and analyses reports, publishes guidance and red-flag indicators (Article 40 of the FIC Regulations) and keeps the national statistics. Sector supervisors check compliance: under Article 43 of the AML Law a supervisory authority regulates and monitors its reporting persons, licenses them, keeps criminals and their associates out of significant holdings and management, and conducts risk-based supervision. In practice the National Bank of Rwanda (BNR) supervises banks, microfinance institutions, insurers, payment service providers, foreign exchange bureaus and trust and company service providers; the Capital Market Authority (CMA) supervises capital market licensees and, since Law N° 023/2026 of 25/05/2026, virtual asset service providers, and has its own regulations on administrative sanctions for AML failures by capital market players. Suspected offences are investigated by the Rwanda Investigation Bureau (RIB) and prosecuted before the courts.

The AML Law defines its key terms broadly. A beneficial owner is the natural person who ultimately owns or controls a customer or on whose behalf a transaction is conducted, including anyone with ultimate effective control of a legal person or arrangement. A politically exposed person is someone entrusted with a prominent public function by Rwanda, a foreign State or an international organisation, with family members and close associates. Money laundering covers proceeds of crimes committed in Rwanda or abroad. And 'immediately' means within 24 hours at the latest (Article 2), a definition echoed in the targeted financial sanctions regulations, where it means without delay but no later than 24 hours after the decision is made, and that drives the freezing and reporting deadlines.

Is your business a reporting person?

Article 8 of the AML Law lists the reporting persons: (a) financial institutions, defined by activity so as to include deposit-taking, lending, leasing, money or value transfer, issuing payment instruments, investment management and money changing; (b) advocates, notaries, professional bailiffs and other independent legal professionals when they act for a client outside legal proceedings, in particular in buying and selling real estate, managing client money, securities or accounts, organising contributions to companies, and creating, operating or managing legal persons or arrangements or buying and selling businesses; (c) auditors, accountants and tax advisers; (d) real estate agents; (e) dealers in precious metals and precious stones; (f) persons in the business of distributing money; (g) casinos and national lottery gaming halls; (h) trust and company service providers; and (i) virtual asset service providers. An Order of the Minister may add others.

The list matters to investors in two ways. First, a business in one of these sectors, such as a fintech, a property brokerage, a dealer in precious metals or stones, a corporate services firm or a casino, carries its own AML obligations, registration and reporting duties, and its licence depends on them (FAQ 86). Second, every other business deals with reporting persons, above all its bank, its lawyers and its auditors, and will be asked for the information they need to perform customer due diligence on it. Mining and mineral-trading businesses have additional traceability and due diligence obligations under the mining framework, explained in Sanctions, due diligence and reforms in the mining sector.

Registration, risk assessment and the compliance officer

Under Article 9 of the AML Law and Articles 3 and 4 of the FIC Regulations, a new reporting person must register with the FIC through the Centre's system within 30 days after obtaining its certificate of incorporation, and must notify any change to its registration particulars in writing within seven working days. Failing to register on time is fined RWF 8,000,000 to RWF 10,000,000, and late notification of changes RWF 500,000 per day of delay for up to 30 days (Articles 3 and 4 of Regulations N° 001/FIC/2026).

Article 5 of the FIC Regulations requires a risk-based approach: the reporting person conducts and documents an institutional risk assessment at least once a year, and whenever its business, customer profile or services change significantly, informed by the national and sector risk assessments. It must have policies, procedures and internal controls (Article 29 of the AML Law and Article 32 of the FIC Regulations), an independent audit function (Article 33), training (Article 34) and group-wide controls over foreign branches and subsidiaries (Article 35). Failing to conduct the risk assessment is fined RWF 1,000,000 to RWF 3,000,000 (Article 7 of Regulations N° 001/FIC/2026).

Article 6 of the FIC Regulations requires a compliance officer at managerial level with sufficient authority, seniority and resources to act independently, with direct and unfettered access to the board, to which he or she reports compliance status. The FIC must be told of the appointment within three working days and of any change within 24 hours. Each year the reporting person files an annual compliance report with its supervisory authority, copied to the FIC (Article 44). For a foreign group setting up a regulated business in Kigali, the compliance officer should be one of the first hires.

Customer due diligence

Customer due diligence (CDD) is required before establishing a business relationship and for occasional transactions above the thresholds. The basic measures are to identify and verify the customer and its beneficial owners and to understand the purpose and intended nature of the relationship (Article 7 of the FIC Regulations; Articles 12 to 14 of the AML Law). For a company, the basic account-opening file contains the identification and identity numbers of the customer and its beneficial owners, the identity of signatories, the full professional address, the legal form, status and structure, the country of establishment, proof of incorporation and registered office, the nature and purpose of the activity and the expected use of the account (Article 11 of the FIC Regulations). The reporting person must verify that anyone acting for the customer is authorised (Article 12), and treat non-face-to-face customers by the same procedures as those met in person (Article 13); the practical steps are in Opening corporate bank accounts.

Verification may be completed after the relationship begins only if this happens as soon as reasonably practicable, is essential not to interrupt normal business and the risks are effectively managed (Article 16 of the AML Law). Simplified measures are allowed for lower risks, and enhanced measures are mandatory for higher risks (Articles 8 and 9 of the FIC Regulations). A foreign politically exposed person is always treated as high-risk; a domestic or international organisation's politically exposed person is assessed case by case (Article 10). Customers connected with higher-risk countries attract enhanced measures and any countermeasures the FIC prescribes (Article 31 of the AML Law; Articles 18 and 19 of the FIC Regulations), and correspondent banking relationships have their own rules (Article 20). Existing customers are reviewed on the basis of materiality and risk, for example when ownership changes or transactions stop matching the customer's profile (Article 17 of the AML Law).

Article 15 of the FIC Regulations sets the triggers for occasional transactions: RWF 10,000,000 or more; a domestic or cross-border wire transfer, payment or value transfer of RWF 1,000,000 or more; a casino transaction of RWF 3,000,000 or more; a cash transaction of RWF 15,000,000 or more with a dealer in precious metals or stones; every real estate purchase or sale, with due diligence on both buyer and seller; and specified trust and company services such as forming companies, acting as or providing nominee directors, providing a registered office and acting as trustee. Linked transactions are added together. Wire transfers must carry originator and beneficiary information, fuller above the RWF 1,000,000 de minimis threshold (Articles 21 to 31).

Reporting to the Financial Intelligence Centre

A reporting person must report to the FIC whenever it suspects, or has reasonable grounds to suspect, that funds or other assets are the proceeds of crime or are linked to money laundering, terrorist financing or proliferation financing, regardless of the amount and including attempted transactions (Article 32 of the AML Law). The report is made on the FIC's template, electronically or through another channel the FIC sets, within 24 hours from the occurrence (Article 39 of the FIC Regulations). Separately, cash transactions and value transfers at or above the thresholds in the table are reported within two working days from the transaction, whether or not anything is suspicious (Article 33 of the AML Law; Articles 41 and 42 of the FIC Regulations).

Under Article 34 of the AML Law, the reporting person, its directors, senior managers and employees may not disclose that a suspicious transaction report has been filed, and they are protected from criminal and civil liability for breach of any confidentiality restriction if they report in good faith, even if they did not know precisely what the underlying crime was and whether it actually occurred. Revealing a report to a third party or warning the person concerned is an offence under Article 63. Failing to submit a required report, or submitting an incomplete or erroneous one, is an administrative fault fined RWF 2,000,000 to RWF 4,000,000 per report, rising to RWF 5,000,000 to RWF 7,000,000 where the aim was to hide a fault (Article 6 of Regulations N° 001/FIC/2026).

Beneficial ownership

Beneficial ownership is the point at which the AML regime and company law meet. A person holding 25% or more of the shares or voting rights is a beneficial owner under Instructions of the Registrar General N° 001/2023/RG of 31/03/2023, and the Companies Law requires every company to keep a register of beneficial owners, file it with the Registrar General at the Rwanda Development Board (RDB) and report changes within 14 days (Beneficial ownership and transparency). Article 35 of the AML Law requires the registration authority to keep adequate, accurate and updated beneficial ownership information and to make it publicly available in a timely manner.

Banks do not stop at the register. They must identify every natural person who ultimately owns or controls the customer, which for a fund, trust or layered group means tracing through each holding vehicle to individuals, and they will compare what the customer tells them with the Registrar General's records. A discrepancy is itself a reason for enhanced scrutiny and, if unexplained, a possible suspicious transaction report. Investors who hold through trusts, nominees or funds should prepare a structure chart with ownership percentages and the identity documents of each beneficial owner before approaching a Rwandan bank.

Targeted financial sanctions and screening

Rwanda implements United Nations sanctions through Regulations N° 001/FIC/2025 of 15/01/2025 relating to targeted financial sanctions and the National Counter-terrorism Committee, whose responsibilities for targeted financial sanctions are determined by a Prime Minister's Order under Article 67 of the AML Law. A designated person is one listed as a terrorist or financier of terrorism or proliferation under domestic law or United Nations Security Council resolutions. The domestic list is published on the website of the Ministry in charge of justice and the United Nations list is accessible through the FIC's website (Article 4), and the FIC disseminates designations and changes to reporting persons and others (Article 5).

Every reporting person, supervisor and competent authority must screen names and addresses against the consolidated list on receipt of each list and before establishing any business relationship (Article 6). On a match, it must freeze or seize all funds and assets owned or controlled by the designated person, directly or indirectly, including those held in the name of associates or relatives, without prior notice to that person, and report to the FIC (Article 7). 'Immediately' means without delay and no later than 24 hours. Frozen funds stay frozen until delisting; the FIC may appoint an administrator; a designated person may apply for access to cover basic or extraordinary expenses (Articles 8, 12 and 14); and reporting persons must report any frozen assets, attempted dealings and assets held by the designated person in the three years before designation (Article 13). Breaches are fined RWF 3,000,000 to RWF 5,000,000 for an individual and RWF 5,000,000 to RWF 20,000,000 for a legal person (Article 27). The BNR may also prohibit any transfer of foreign currency abroad to meet Rwanda's international obligations (Article 33 of Regulation N° 42/2022).

Rwandan law gives effect to United Nations and domestic designations, not to the unilateral sanctions of other states. Those regimes, such as the United States, European Union and United Kingdom programmes, still bind a foreign investor through its own nationality, its group's place of incorporation or the currency and banks used, and Rwandan banks with correspondent relationships in those currencies screen against them in practice. A group should therefore screen its Rwandan counterparties against every list that applies to it, not only the Rwandan one.

Cross-border cash

Under Article 36 of the AML Law and Article 5 of Regulation N° 001/FIC/2023, a person entering, transiting through or leaving Rwanda with cash or bearer negotiable instruments worth RWF 10,000,000 or more, or the equivalent in other currencies, must make a truthful declaration or disclosure to the competent authority, in advance or at the border on the available form. Amounts carried by an accompanied person under 18 are added to the accompanying adult's. A false declaration or failure to declare allows officers to stop and hold the courier and the cash for further action, question the courier on the origin and intended use of the funds, and immediately impose an administrative fine of 5% of the amount, without prejudice to criminal sanctions; the FIC is informed within 30 minutes (Article 7). Investors bringing capital into Rwanda should use bank transfers, which create the paper trail the bank will later need for repatriation (FAQ 69).

Penalties

The AML Law's criminal penalties are among the heaviest in Rwandan law. Money laundering carries 10 to 15 years' imprisonment and a fine of three to five times the value of the proceeds laundered (Article 56); terrorist financing 20 to 25 years and a fine of three to five times the financing, or life imprisonment where death results (Article 57). A legal person convicted of either is fined 10 to 20 times the value of the proceeds or financing and may be dissolved, have its premises permanently closed and see the judgment published (Article 62). Penalties are doubled for organised crime or recidivism (Article 65), and on conviction the court orders confiscation of the laundered assets, proceeds, instrumentalities and property of equivalent value (Article 68).

Breaches of the preventive duties are offences in their own right under Article 66: a person who fails to meet the obligations on CDD, politically exposed persons, correspondent banking, wire transfers, internal controls, reporting or tipping off faces one to three years' imprisonment or a fine of RWF 1,000,000 to RWF 5,000,000, and a legal person a fine of RWF 5,000,000 to RWF 20,000,000. On top of these, the FIC's administrative fines under Regulations N° 001/FIC/2026 apply to specific faults, and supervisors such as the BNR and the CMA impose their own sanctions, including on licences.

Rwanda's international standing

Rwanda's anti-money-laundering system was assessed by the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), the FATF-style regional body for the region, which applies the standards of the Financial Action Task Force (FATF), in a mutual evaluation report published in July 2024. On technical compliance with the 40 FATF Recommendations, Rwanda was rated Compliant on 5, Largely Compliant on 14, Partially Compliant on 20 and Non-Compliant on 1 (Recommendation 8, on non-profit organisations); on effectiveness, 10 of the 11 Immediate Outcomes were rated low. Rwanda was placed in enhanced follow-up. Its second enhanced follow-up report, adopted by ESAAMLG in August 2025, credited the 2025 AML Law and related measures and re-rated four Recommendations: R.2 (national cooperation and coordination) and R.12 (politically exposed persons) to Compliant, and R.5 (terrorist financing offence) and R.14 (money or value transfer services) to Largely Compliant, while R.15 (new technologies), R.22 (customer due diligence for designated non-financial businesses) and R.35 (sanctions) stayed Partially Compliant. On the FATF's published ratings that takes Rwanda to 7 Compliant, 16 Largely Compliant, 16 Partially Compliant and 1 Non-Compliant; effectiveness ratings are not revisited in technical compliance follow-up. The 2026 FIC Regulations continue that work. Rwanda was not on the FATF's list of jurisdictions under increased monitoring published on 19 June 2026, which spares Rwandan banks the correspondent-banking pressure that listing brings, although each foreign bank still makes its own risk assessment of Rwandan counterparties.

Setting up an AML programme for a regulated business in Rwanda

1. Confirm the statusCheck whether the business falls within Article 8 of the AML Law, and identify the supervisor (BNR, CMA or other) whose licence and AML rules apply.
2. Register with the FICRegister through the FIC's system within 30 days after incorporation, and diarise the seven-working-day rule for later changes.
3. Appoint the compliance officerAppoint a manager with authority, resources and board access, and notify the FIC within three working days.
4. Assess the risksDocument an institutional risk assessment of customers, countries, products, services and channels, informed by the national risk assessment, and repeat it at least yearly.
5. Write the policies and controlsCDD, enhanced due diligence for foreign politically exposed persons and higher-risk countries, wire transfer data, sanctions screening, freezing, reporting, record keeping, training and independent audit.
6. Connect the screening and reporting toolsScreen customers against the domestic and UN lists before onboarding and on each list update; set up suspicious (24 hours) and threshold (two working days) reporting to the FIC.
7. Report and reviewFile the annual compliance report with the supervisor and FIC, keep records for ten years, and update the programme when the business or the rules change.