Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.
What Rwanda actually says
Rwanda uses a technique worth understanding because it is different from a ban. Rather than prohibiting anonymity-enhanced assets, the law writes them out of the definition of a virtual asset altogether, alongside NFTs, algorithmic stablecoins and central bank digital currencies. The effect is that no licensed provider can deal in them, because they are not the thing the licence covers. Whether dealing in them is otherwise lawful is left unanswered, which is a meaningfully different position from prohibition. More surprising is the treatment of mixers: operating one without authorisation is an offence, and the drafting implies such services could in principle be authorised. Very few regimes anywhere treat mixing as licensable rather than forbidden.
The instruments that matter
- Law nº 023/2026 of 25 May 2026, gazetted 28 May 2026
- Rwanda's first law regulating virtual asset business, with the Capital Market Authority as lead regulatory authority
- Anonymity-enhanced assets are excluded from the definition
- the definition of virtual asset expressly excludes them, alongside central bank digital currencies, NFTs, algorithm-based stablecoins and closed-loop systems, so they sit outside the licensed perimeter entirely
- Mixers are licensable, not banned
- operating mixer or tumbler services, mining facilities or crypto ATMs without authorisation is an offence, which implies such services can in principle be authorised
- Travel rule mandatory
- originator and beneficiary information requirements apply to virtual asset transfers, with suspicious transaction reporting regardless of amount
- Implementing regulations not yet issued
- licence categories remain undefined and transition arrangements for existing operators are unspecified
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- GhanaMiddle East & Africa · The regulator that put self-custody in writing
- IsraelMiddle East & Africa · Light on-chain, heavy on data protection
- MauritiusMiddle East & Africa · A mature licensing regime that never mentions anonymity
- NigeriaMiddle East & Africa · Securities-first, with banking access restored
- SeychellesMiddle East & Africa · No anonymity rule, but the offshore route is closing
- BahrainMiddle East & Africa · A listing test written against effects, not asset names
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.