Imagine you buy a share in a company today. You pay, you get a confirmation message, and you feel like you “own” that share. But here’s the big question:
Where does your ownership live?
Who keeps the official record that proves the share is yours and can be transferred safely if you sell it tomorrow?
In modern markets, ownership is tracked electronically (not on paper), and that depends on reliable market infrastructure. Rwanda has been strengthening this infrastructure alongside investor education and broader market development to support a growing capital market ecosystem.
That’s why Rwanda’s Capital Market Authority (CMA) issued Regulations n° 001/CMA/2026 (dated 12/01/2026, published in the Official Gazette Special of 16/01/2026) on licensing CSD operators and authorizing CSD participants with a clear focus on protecting investors (securities holders).
What is CSD?
A Central Securities Depository (CSD) is like a secure digital record book for investments such as shares and bonds. It records ownership electronically (book-entry), so ownership can be updated when people buy or sell securities.
Why it matters? If this “record book” is weak, markets can face problems like errors in ownership records, slow settlement, or disputes about who owns what. That’s why CMA focuses on strong rules and infrastructure to protect investors and support orderly markets.
Two key roles: Operator vs Participant
The Regulations mainly talk about two types of players.
CSD Operator the “system manager”
A CSD operator is the National Bank of Rwanda (Central Bank) or any company licensed by CMA to conduct some or all CSD activities in Rwanda.
CSD Participant the “approved user”
A CSD participant is an institution/person/entity authorized by CMA to open and hold securities accounts with the CSD operator.
Simple analogy:
- The operator is the organization running the main system.
- Participants are approved by institutions allowed to access and use that system responsibly.
Why did CMA introduce these Regulations?
CMA states that the Regulations set:
- licensing requirements for CSD operators, and
- authorisation requirements for CSD participants,
to protect securities holders (investors).
This fits into the broader effort to strengthen Rwanda’s capital market ecosystem through improved infrastructure, stronger supervision, and investor education.
PART I. Licensing a CSD Operator (Running the system)
Who must apply for a CSD operator license?
Anyone other than the Central Bank can only operate (or even claim to operate) as a CSD operator if they have obtained a license from CMA.
What does a CSD operator license application include?
- certified incorporation documents,
- shareholding structure (including beneficial owners),
- personal declaration forms for proposed directors and senior managers (Annex 2),
- credit reports from a licensed credit bureau for the applicant and key persons,
- a business plan,
- operating manuals and risk management procedures,
- CSD rules and system description (including how the system connects with other systems),
- IT policies including cyber risk management, business continuity and disaster recovery plans,
- AML checks and customer due diligence, plus internal complaint/dispute handling mechanisms.
Note: CMA can request additional information if needed.
“Fit and Proper” checks (what CMA looks for)
When CMA assesses an operator license application, it checks integrity and competence of the applicant and senior managers.
This includes considerations like financial soundness, qualifications and experience, serious convictions, past misconduct/fraud, regulatory breaches, involvement in failed or sanctioned firms, bankruptcy, unpaid judgment debts, and asset sequestration.
In simple words: CMA wants to ensure the people running the CSD are trustworthy and capable because this system affects investor rights.
Money requirements for CSD operators (key numbers)
To apply, the operator must show:
- a non-refundable application fee of FRW 2,000,000,
- a deposit certificate showing at least FRW 500,000,000 deposited into the applicant’s account in a licensed Rwandan bank,
- an undertaking to always maintain FRW 400,000,000 in liquid capital in banks licensed in Rwanda,
- independent auditor-certified evidence confirming capital availability and an undertaking to maintain minimum capital requirements.
How long does CMA take to decide? (Operator licensing timeline)
Here’s the timeline in plain language:
- CMA acknowledges whether your application file is complete within 5 working days.
- If it’s incomplete, CMA lists what’s missing and sets a deadline, and won’t proceed until it is completed.
- After receiving a complete file, CMA communicates its decision within 30 days and must provide the final decision within 90 days of receiving the complete application.
CMA may: grant the license, grant it with conditions, grant a limited license (only part of activities), or refuse with reasons.
If CMA refuses, can the applicant respond or appeal?
Yes. If requirements are not met, CMA must give the applicant an opportunity to be heard before refusing.
If CMA still refuses, it must notify the applicant and explain reasons within 10 working days after hearing them.
The applicant can appeal to the Capital Market Independent Review Panel within 14 days of notification.
After approval: license fee and annual supervision fee
If CMA grants a license, the operator pays:
- a license fee of FRW 1,000,000 within 7 days after the licence is granted,
- and an annual supervision fee equal to 1% of gross annual revenue.
The license remains valid unless suspended or revoked.
PART II. Authorizing CSD Participants (Using the system)
Who needs CMA authorization to be a CSD participant?
A company incorporated in Rwanda intending to hold book-entry securities on behalf of third parties must obtain CMA authorization before starting that activity.
The authorization request is accompanied by a program of operations (type/volume of business, organizational structure, and close links), and CMA may set conditions for the applicant to comply with.
Who can qualify as a participant?
An authorization may be granted if the institution is, for example:
- a financial institution licensed by the Central Bank, or
- a financial institution/capital market intermediary licensed or approved by CMA, or
- an issuer of securities.
What systems and controls must participants have?
CMA expects participants to meet requirements relating to people, technology, and accounting.
A) People (Human resources)
Participants should document job roles and required skills, prepare an organizational chart, and show that staff managing information systems have appropriate professional skills.
B) Technology (IT)
Participants must have IT systems suited to their size and transaction volume, with controlled/monitored access, change records, documented system architecture, and updated lists of hardware/software.
C) Accounting (Recordkeeping)
Participants must maintain accounting procedures that support double-entry bookkeeping, daily transaction records, and simultaneous recording of securities and related financial transactions.
Money requirements for participants (key numbers)
To be authorized, a participant must show:
- a minimum paid-up cash capital of FRW 300,000,000 in a licensed Rwandan bank,
- an undertaking to maintain liquid capital of FRW 200,000,000 or 30% of total liabilities (whichever is always higher),
- independent auditor-certified evidence confirming the capital and a commitment to maintain it.
How long does participant authorization take?
CMA decides on authorization within 60 days from the date the applicant submits the required information and communicates the decision within 15 days of the decision date.
CMA also publishes a list of authorized participants on its website, and the CSD operator publishes and updates its own list, notifying CMA within 3 days of changes.
PART III. What about foreign (non-Rwandan) participants?
A foreign CSD participant may be authorized if it is supervised under a comparable regime, allows access for CMA’s supervisory duties (through people acting on CMA’s behalf), and holds a license in its home country where applicable.
CMA may refuse authorization if there is no reciprocal market access for Rwanda-governed participants under similar conditions.
Conclusion
Rwanda’s 2026 CMA Regulations on the Central Securities Depository (CSD) are essentially about trust: ensuring that the “official record” of who owns shares or bonds is protected by strong rules, strong systems, and accountable institutions. Whether an organization wants to run the CSD (as a licensed operator) or access it (as an authorized participant), the Regulations set clear expectations around governance, competence, technology controls, risk management, and minimum capital so that investors’ holdings are safeguarded and the market remains orderly.
Disclaimer: “Informational only, not legal/financial advice. Views are the author’s own; no affiliation or endorsement is implied”.
Acivaz Consulting 