Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026

Anyone providing virtual asset services in Zimbabwe must register with the Financial Intelligence Unit. There is no application fee; the registration issuance fee is US$500 and annual renewal is US$400, all non-refundable and accruing to the Reserve Bank. A certificate lasts one year, cannot be transferred, and must be displayed at every place of business in both physical and digital form, with a QR code linking to the official register entry.

The applicant must be incorporated in Zimbabwe, and a multinational group must operate through a Zimbabwean subsidiary. The application requires certified incorporation documents, certified IDs and proof of residence for every beneficial owner, director and principal officer, police clearance certificates dated within six months, a valid tax clearance certificate, proof of physical premises, an ownership structure chart, fit and proper declarations, an entity-specific money laundering and terrorist financing risk assessment, an AML/CFT policy, details of affiliated entities inside and outside Zimbabwe, the proposed compliance officer's name and qualifications, and documented data protection and cyber-security safeguards. Incomplete applications are treated as abandoned, and the Unit decides within ninety days of a complete application.

Ongoing obligations are firm. A registrant must keep at least two resident directors at all times, appoint a money laundering compliance officer resident in Zimbabwe with real authority and independence, maintain a registered office in Zimbabwe from which all records are accessible, and notify the Unit of any material change within forty-eight hours. Breaching the residence, director or compliance-officer requirements carries a fine of up to US$50 000 each; a false or misleading application carries up to US$10 000, a six-month bar on reapplying, and revocation.

The travel rule now applies in full. For every transfer, the ordering provider must obtain and hold the originator's full legal name, wallet address or account number, physical address or national ID or passport number, and date and place of birth, together with the beneficiary's name, wallet address and country and town of residence. It must verify the originator's details through independent KYC before executing, then transmit the information immediately and securely to the beneficiary provider, which must have procedures to spot transfers arriving without it.

Transfers to unhosted wallets get special treatment. Above US$1 000, the ordering provider must obtain the beneficiary details from its own client and carry out wallet ownership proof — a Satoshi test or cryptographic signature — to confirm the client actually controls the wallet, with enhanced monitoring for sanctions evasion. Customer due diligence applies to all transactions, single or linked, at or above US$1 000: identify and verify the customer and any beneficial owner, establish the purpose of the relationship, monitor on an ongoing basis, and retain records for five years after the relationship ends.

Decentralised finance is deliberately caught. A person is treated as providing virtual asset services where, as a business or for commercial benefit, they control or provide the essential means for a software protocol, smart contract or decentralised application. Control is defined to include the ability to upgrade the protocol's logic, withdraw or reallocate substantial assets held within it, change its fees or economic parameters, direct its governance, or simply market oneself as its operator.

Registration can be suspended by the Director General where urgent and necessary in the public interest, with seven days to respond, or immediately where delay would prejudice the public. It can be revoked for a money laundering or terrorist financing offence, materially false information at application, ceasing to operate for more than thirty days, liquidation, no longer being fit and proper, or conducting business detrimental to the public interest — and without notice where the public interest requires. The Unit maintains a public register on its website, categorised by authorised service and open to inspection.