The Minister of Finance, Economic Development and Investment Promotion, Professor Mthuli Ncube has gazetted a detailed framework to regulate virtual asset service providers (VASPs), aiming to strengthen anti-money laundering controls while promoting innovation and consumer protection in Zimbabwe’s digital asset sector.
A Virtual Asset Service Provider is a business that carries out digital asset activities for customers, acting as the link between decentralized networks and traditional finance. Because of this role, VASPs are subject to strict anti-money laundering and counter-terrorist financing regulations.
Rainbow Hotels — Experience Luxury Across Zimbabwe
Rainbow Hotels continues to redefine hospitality standards in Zimbabwe, offering world-class accommodation, fine dining, and modern conference facilities in Harare, Bulawayo, and Victoria Falls.
Whether for business or leisure, Rainbow Hotels delivers unmatched comfort, exceptional service, and a truly premium guest experience tailored to modern travellers.
Book NowVASPs serve as key intermediaries in the digital asset ecosystem. Common types of VASPs include cryptocurrency exchanges, custodial wallets, and token issuers, among others.
Statutory Instrument 99 of 2026, the Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026, was issued under section 103 as read with section 3A(1)(a) of the Money Laundering and Proceeds of Crime Act [Chapter 9:24]. The regulations establish mandatory registration, ongoing compliance obligations, and enforcement mechanisms for any entity offering services relating to virtual assets in Zimbabwe.
Eight Principles Anchor the New Regime
The regulations are founded on eight core principles: market integrity, consumer protection, financial stability, innovation enablement, transparency and accountability, risk management, global interoperability, and trust and confidence. The framework seeks to reduce fraud and manipulation, safeguard users from loss and mismanagement, prevent systemic risk to the broader financial system, and give entrepreneurs regulatory clarity to build new products. VASPs must disclose operations and risks, identify and mitigate cyber and liquidity threats, and operate under harmonised standards that support cross-border commerce.
Strict Registration Requirements
Any person wishing to operate as a virtual asset service provider must apply to the Financial Intelligence Unit using the prescribed VASPR Form and pay the prescribed fee. Applications must include certified incorporation documents, ID copies for all beneficial owners, directors and principal officers, proof of residence, and Zimbabwe Republic Police clearance certificates dated within six months for each key person.
Applicants must detail the nature, size, scope and complexity of the business, describe the underlying technology, service delivery method, and virtual assets to be used, and provide proof of physical business premises and head office address in Zimbabwe. An ownership structure chart, valid tax clearance, and completed fit and proper declarations for all beneficial owners, directors and principal officers are also required.
Crucially, every applicant must submit an entity-specific risk assessment of money laundering, terrorist financing and proliferation financing risks, together with policies for identifying, monitoring and mitigating those risks. A written AML/CFT/CPF compliance policy, data protection and cyber-security safeguards, and the name and qualifications of a proposed compliance officer must accompany the application.
All applicants must be incorporated or registered as a legal entity in Zimbabwe. Multinational groups may only operate through a Zimbabwe-incorporated subsidiary, which must appoint a locally resident authorised representative who meets fit and proper standards. Any change of representative must be reported to the Unit within 14 days.
The Unit may request additional information and will deem applications incomplete and abandoned if requirements are not met within set periods. False or misleading declarations are grounds for rejection or revocation, carry a six-month ban on reapplication, and constitute an offence punishable by a fine of up to US$10,000. The Unit must determine complete applications within 90 days
.Approval, Conditions, and Certificate Display
The Unit may approve registration if the applicant meets prescribed requirements, intends to carry on the business, and all principal officers and persons with a significant interest are fit and proper. The applicant must demonstrate capacity to manage risks, including those involving anonymity-enhancing technologies such as mixers and tumblers. Registration cannot be contrary to public interest.
Upon approval and payment of the issuance fee, the Unit will allocate a unique registration number, issue a certificate of registration valid for one year, and enter the VASP into the official Register. Conditions may be imposed. Certificates cannot be assigned or transferred. Registrants must prominently display the certificate, in physical and digital form, at all service points. Online services must include a QR code linking to the official registry entry confirming authorisation.
Renewals and Ongoing Obligations
Renewal applications must be filed within 90 days before expiry, with updated fit and proper declarations, tax clearance, proof of premises, and a revised risk assessment. Late renewals attract a fine not exceeding level 6.
Registrants must maintain fit and proper beneficial owners and principal officers, appoint a resident money laundering compliance officer with authority and independence, and have at least two resident directors at all times. Any material change in ownership, control, management, operations or compliance status must be reported immediately. Failure to comply can result in fines of up to US$50,000.
All VASPs must keep records accessible at their Zimbabwe-registered office and notify the Unit of any change of address within seven days. Material changes to information provided at application must be reported within 48 hours. Failure to notify carries fines up to US$50,000.
Enforcement and Unregistered Operators
The Unit is empowered to establish systems to identify unregistered persons carrying on or purporting to carry on virtual asset services, and to share information with competent authorities and financial institutions.
Registration may be suspended urgently by the Director General to protect public interest, with the VASP given seven days to respond. Immediate suspension is permitted where delay could prejudice the public or financial services industry. Suspended VASPs must cease business activities but remain subject to obligations and Unit directions. Suspension extends to agents or representatives.
The regulations mark Zimbabwe’s first dedicated legal regime for virtual assets, aligning with Financial Action Task Force standards on the Travel Rule, customer due diligence, and risk-based supervision. By mandating local incorporation, resident officers, and detailed risk controls, the framework seeks to build trust in digital assets while preventing their misuse for illicit finance.
