E-commerce, fintech and AI: the RICA e-commerce licence, seller disclosures and the seven-day withdrawal right under Law N° 011/2026, electronic contracts and signatures, BNR payment service licences and the regulatory sandbox, the 2026 virtual assets law administered by the Capital Market Authority, VAT on digital services and the pending digital services tax, and Rwanda's approach to artificial intelligence

The rulebook for Rwanda's digital economy

Rwanda regulates digital business by activity rather than through a single digital code. Selling goods or services online is governed by the e-commerce chapter of Law N° 011/2026 of 26/02/2026 relating to competition and consumer protection, in force since 4 March 2026, administered by the Rwanda Inspectorate, Competition and Consumer Protection Authority (RICA), which the Law calls the Regulatory Authority. Contracts and signatures made electronically rest on Law N° 24/2016 of 18/06/2016 governing information and communication technologies (the ICT Law) and the 2024 evidence law. Payments and e-money are licensed by the National Bank of Rwanda (BNR); virtual assets, since May 2026, by the Capital Market Authority (CMA). Data, cybersecurity and tax rules apply to all of them, and artificial intelligence is so far a matter of policy rather than statute.

Each layer adds a licence or a duty, and a single business model often needs several. An online marketplace with an in-app wallet needs an RDB company registration, a RICA e-commerce licence, a BNR payment licence or a licensed partner, an NCSA data protection certificate and VAT registration; if it accepts crypto-assets it also enters the CMA's regime. Sector and investment questions are covered in Sectors open to foreign investors and licensing, and data and cyber duties in Personal data protection and Cybersecurity and critical information.

E-commerce under Law N° 011/2026: scope and the licence

Chapter VI of Law N° 011/2026 is Rwanda's first general e-commerce regime. E-commerce is conducted where an enterprise sells, or an enterprise or consumer buys, a good or service in whole or in part by electronic means, whether or not an online intermediary is used and whether payment is made electronically or in physical form; electronic means include the internet, mobile commerce applications and social networks (Article 41). A business selling through its own website, a marketplace, a messaging app or a social media page with cash on delivery is therefore within the Law.

Article 44 provides that an enterprise wishing to engage in e-commerce or provide online intermediary services applies in writing to the Regulatory Authority for the corresponding licence, and that regulations of the Regulatory Authority determine the other licensing matters. Existing e-commerce operators had a period not exceeding six months from publication in the Official Gazette on 4 March 2026 to conform (Article 73), so the transition ended in early September 2026. RICA's implementing regulations, which will set the application procedure, documents and any fee, had not been located at 10 October 2026, and operators should approach RICA directly and keep evidence of their application. Engaging in e-commerce without authorisation or without complying with the applicable requirements, and displaying false information on a platform or refusing to remove it, are faults under Article 67, punished by administrative fines banded by the preceding year's turnover: RWF 30,000 below RWF 2,000,000; RWF 50,000 to RWF 100,000 up to RWF 20,000,000; RWF 200,000 to RWF 300,000 up to RWF 1,000,000,000; and RWF 500,000 above that, doubled for a repeat within two years and quadrupled for a third. An operator that wishes to close publishes a notice on its website at least 30 days before ceasing business (Article 48).

What an online seller must disclose and do

Article 42 lists the obligations of an e-commerce enterprise. On its online interface it must show the names of the owner, the name, registration number and place of registration of the enterprise, its physical address in Rwanda, telephone number, interface and email address, the mobile number for after-sales service, the name and mobile number of the consumer complaint officer, and its rules of procedure. Before the transaction it must show the total price including transport, taxes and other foreseeable charges; the terms on refunds, returns, delivery and payment; the right of withdrawal, guarantees, expiry dates and the complaint mechanism; the delivery time; the payment methods, their security, fees, cancellation and charge-back options and the payment provider's contact details; its privacy and payment security policy; how the consumer can keep a record of the transaction; the dispute resolution means; and any minimum contract duration.

It must then acknowledge a complaint within 72 [hours] of receipt (the Gazette text omits the unit) with an indication of the procedure, or respond within 15 days; record the consumer's consent to each purchase; refrain from submitting or commissioning false or misleading reviews, ratings or endorsements; issue an electronic proof of purchase received by the consumer in real time; publish how consumers can access, correct or delete their data or unsubscribe; make advertisements identifiable with a free opt-out from mailing lists; and comply with any further obligations RICA prescribes. The physical-address requirement means that a foreign seller targeting Rwandan consumers needs a local presence or a local operator, and the complaint officer must be reachable by a Rwandan mobile number.

Electronic contracts and signatures

The ICT Law, which repealed Law N° 18/2010 of 12/05/2010 relating to electronic messages, electronic signature and electronic transactions (Article 309), gives electronic records legal effect (Article 134) and provides that a contract may be formed by electronic messages unless both parties agreed otherwise or where laws provide otherwise (Article 158). Electronic records are admissible in evidence (Articles 145 and 146), every person has the right to use an electronic signature with certificate rules set by the Rwanda Utilities Regulatory Authority (RURA) (Article 147), foreign certificates are recognised if they offer equivalent reliability (Article 148), electronic notarisation is provided for (Article 149) and the Law is technology-neutral (Article 150). Electronic certification service providers are licensed and may be accredited (Articles 175 to 179). Law N° 062/2024 of 20/06/2024 governing evidence gives an electronic signature the same probative value as other evidence (Article 42), as explained in Commercial contracts in Rwanda.

Article 133 of the ICT Law contemplates a Prime Minister's Order listing transactions excluded from its electronic transaction rules, but no such Order had been located at 10 October 2026, and the exclusions often cited for land and wills belonged to the repealed 2010 law. Where another law requires a notarised, registered or handwritten document, as for the transfer of land or a will, that law's formalities still apply by virtue of the proviso in Article 158. For online consumer contracts, the e-commerce rules on pre-contract information, consent records and electronic receipts in Law N° 011/2026 sit on top of the ICT Law.

Payments and e-money: BNR licensing

Payment services are regulated by Law N° 061/2021 of 14/10/2021 governing the payment system and by BNR's Regulation N° 74/2023 of 18/09/2023 governing payment service providers, with separate regulations on e-money issuers (Regulation N° 54/2022 of 01/09/2022) and remittance services (Regulation N° 64/2023), and Regulations N° 94/2026 of 11/05/2026 governing acquisition and amalgamation for payment service providers and payment system operators. BNR licenses an applicant that is a company incorporated under Rwandan company law, has a permanent place of business or registered office in Rwanda, and has a chief executive officer or managing director who is a citizen or resident of Rwanda (Article 15). The chair of the board and the chief executive may not be the same person or related parties.

BNR checks completeness and notifies missing information within seven working days (Article 30) and investigates and responds within 90 days after receipt of a complete application (Article 31). A licence is perpetual unless revoked or suspended (Article 39) and is not transferable (Article 40). Licensed providers must interoperate with other providers (Article 47), may not enter exclusivity agreements unless BNR authorises them (Article 48), must notify material changes and violations immediately (Article 50), and must comply with BNR's outsourcing, data protection, agent, cybersecurity and business continuity rules (Articles 44, 52, 53 and 54). The application file runs to some 25 items, including a programme of operations, a three-year business plan, fit-and-proper documents for directors and significant shareholders, a security policy, data protection and AML/CFT policies and proof of payment of the licence fee. Rwanda's payments market and foreign currency rules are described in Payments, currency and mobile money (FAQ 92).

Regulatory sandboxes

A fintech whose product does not fit an existing licence can test it under BNR Regulation N° 41/2022 of 13/04/2022 governing the regulatory sandbox, and Article 43 of the payment services regulation directs innovative or hybrid payment products there. The applicant must show that the product is innovative with clear potential to improve access, efficiency, security or risk management, or to open financing opportunities, and brings real benefits; that it does not clearly correspond to a currently regulated product or is a hybrid; that it falls within BNR's supervisory scope; and that the applicant has assessed it, has resources and a technical architecture, has a plan to deploy at scale and is run by fit and proper persons (Article 4). BNR calls for applications in three cohorts a year and acknowledges completeness within seven working days (Article 7). Testing lasts up to 12 months, extendable by up to 12 months if the innovation has tested positively (Article 8), on a request made 30 working days before expiry (Article 13), within client and exposure limits set in the testing plan.

The CMA runs a separate capital markets sandbox under its Guidelines N° 002/CMA G/2023 of 27/04/2023, and Article 13 of the virtual assets law provides a sandbox for virtual asset business models not covered by that Law, with the application process set by the CMA's and BNR's frameworks; a participant that tests successfully may then apply for a licence or approval.

Virtual assets: Law N° 023/2026

Law N° 023/2026 of 25/05/2026 regulating virtual asset business, published in the Official Gazette n° Special of 28/05/2026 and in force on publication (Article 40), brings crypto-asset business under licence. A virtual asset is a digital representation of value that can be digitally traded or transferred and used for payment or investment; fiat digital representations, BNR-regulated payment instruments, securities, central bank digital currencies, closed-loop systems, unique non-fungible assets, anonymity-enhanced virtual assets and algorithm-based stablecoins are excluded from the definition (Article 4), as are technical assistance, hardware manufacturing and software engineering (Article 3). The CMA is the Regulatory Authority (Articles 2 and 5), cooperating with BNR (Article 8). A legal entity wishing to provide virtual asset services, such as operating a trading platform, clearing, exchange between fiat and virtual assets, transfer, custody, order execution or placement (Article 14), applies to the CMA for a licence; it must be incorporated in Rwanda, or incorporated abroad with registration and a local presence, and hold the minimum capital to be set by regulation, with effective AML/CFT controls (Article 10).

Article 15 sets the boundaries: natural persons may not conduct virtual asset business; virtual assets are not legal tender; they may be used for payments only with BNR's authorisation; virtual asset mining facilities, crypto ATMs and mixer or tumbler services need authorisation; and only licensed providers and approved issuers may market virtual assets. Tokenising real-world assets requires the CMA's prior approval (Article 16), and sovereign assets, public infrastructure, personal identifiable information and artworks may not be tokenised (Article 17). An initial virtual asset offering or a listing on a Rwandan exchange needs approval and a white paper (Article 18), and a stablecoin issuer needs prior approval, a qualified valuer, reserves 100% collateralised, ring-fenced, held by a licensed custodian and segregated from the issuer's assets (Article 19). The penalties are heavy: a natural person in virtual asset business faces RWF 30,000,000 to RWF 50,000,000 and three to five years (Article 33); an unlicensed entity RWF 70,000,000 to RWF 100,000,000 (Article 34); unapproved issuance RWF 120,000,000 to RWF 150,000,000 (Article 35); unlicensed marketing RWF 15,000,000 to RWF 20,000,000 (Article 36); and unauthorised payments, mining, ATMs or mixers RWF 70,000,000 to RWF 100,000,000 for an entity (Article 38). The Law contains no transitional period for existing operators, and the CMA's regulations on capital and administrative sanctions (Article 32) were awaited at 10 October 2026.

Tax on digital business

Income from digital services is Rwandan-source income under Article 6 of Law N° 027/2022 of 20/10/2022 establishing taxes on income. Since Ministerial Order N° 004/26/10/TC of 29/04/2026, non-resident suppliers of online services to customers in Rwanda, including software, platforms and ride-hailing, streaming, online gaming, search, data monetisation, subscriptions, e-learning, hosting and marketplace supplies, must register for VAT or appoint a representative with a business in Rwanda, with no turnover threshold; the supply is in Rwanda if the customer or consumption is in Rwanda or the billing address, IP address, SIM or bank account is Rwandan; and where the supplier is unregistered, the bank or payment provider withholds the VAT. The three-month compliance window ended in late July 2026 (VAT and electronic invoicing).

The digital services tax of 1.5% of gross Rwandan-sourced revenue, inserted as Article 50 bis of the income tax law by Law N° 014/2025 of 27/05/2025, applies by its text to any company supplying digital services with a substantial national presence, Rwandan or foreign, but a Ministerial Order must define its scope and procedure, and RRA was reported in May 2026 as describing it as pending implementation; no implementing Order had been published by 10 October 2026 (Capital gains, property and other taxes). E-commerce sellers also issue invoices from an RRA-certified electronic billing system under Ministerial Order N° 006/26/10/TC, and fintechs should note the reported start on 1 July 2027 of the 15% excise on financial-transaction charges.

Artificial intelligence

Rwanda has no AI statute. The National AI Policy prepared by the Ministry of ICT and Innovation (MINICT) with RURA, and reported as approved by Cabinet in April 2023, proposes a Responsible AI Office, ethical guidelines from RURA and AI regulatory sandboxes. On 8 June 2026 Cabinet approved the establishment of a National Artificial Intelligence Agency to lead AI development, adoption, investment and governance, as reported by The New Times; its founding instrument, mandate and structure had not been published at 10 October 2026. Existing law already governs much of what AI systems do. Article 21 of Law N° 058/2021 gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects, unless it rests on explicit consent, a contract or a law with safeguards; Article 38 requires an impact assessment for automated evaluation and for new technologies; and training data drawn from Rwandan users is subject to registration, transfer and storage rules.

Intellectual property questions are open. Law N° 055/2024 defines an author as a person who created a work and allows a legal entity to be a person, but it says nothing about works generated by AI, and no Rwandan decision on the point had been found (Copyright, software and digital content). Consumer law applies to AI-driven selling: Article 42 of Law N° 011/2026 prohibits false or misleading reviews and endorsements, which covers fabricated reviews however produced. Investors deploying credit scoring, recruitment screening or customer-facing chatbots should document a lawful basis, an impact assessment and a route to human review.

Launching an online business in Rwanda, step by step

1. Incorporate and register for taxRegister a Rwandan company with RDB, obtain a TIN and register for VAT if turnover will exceed the threshold, and set up certified electronic invoicing.
2. Apply for the RICA e-commerce licenceApply in writing under Article 44 of Law N° 011/2026, with a physical address in Rwanda and a named complaint officer; keep proof of the application while RICA's regulations are awaited.
3. Decide how payments will be handledUse a BNR-licensed payment provider, or apply for a Category I to IV licence under Regulation N° 74/2023, or for the sandbox if the model is new; do not hold customer funds without a licence.
4. Register with the NCSARegister as a data controller, appoint a DPO and obtain authorisation for any storage of personal data outside Rwanda (Law N° 058/2021).
5. Build the storefront to Article 42Display identity, address and complaint details; show full prices and terms before checkout; record consent; issue real-time electronic receipts; publish data and unsubscribe procedures.
6. Set up returns and complaintsHonour the seven-day withdrawal right and 15-day refund, acknowledge complaints within the Article 42 period and log them.
7. Check marketing and reviewsLabel advertisements, offer opt-outs and remove fake reviews; do not use minimum resale prices or online-sales bans in supplier terms.