What Zimbabwe's 2025 crypto regulations require of VASPs

Searches for “Zimbabwe cryptocurrency regulations 2025” usually land on the right year but the wrong stopping point. The operative compliance answer is a two-document chain: Finance Act No. 7 of 2025 amended the Money Laundering and Proceeds of Crime Act [Chapter 9:24] so that virtual assets and virtual asset service providers sit inside the anti-money-laundering perimeter; S.I. 99 of 2026 then supplied the registration regime for those VASPs, including application contents, fees, ongoing duties, and penalties.[1]

The status answer is therefore narrower than many headlines suggest. Zimbabwe now has an AML registration framework for VASPs administered through the Financial Intelligence Unit. Registration under that framework is not, by itself, permission to carry on a crypto business in Zimbabwe. The FIU’s own clarification in June 2026 was direct: registration “does not, in itself, constitute authorization to carry on business in Zimbabwe,” and a firm may still need separate approval from the Reserve Bank of Zimbabwe or the Securities and Exchange Commission of Zimbabwe depending on the activity.[2]

The 2025 Act created the AML hook; the 2026 instrument created the filing duty

The first step is statutory classification. Finance Act No. 7 of 2025 amended section 2 of the Money Laundering and Proceeds of Crime Act [Chapter 9:24] to define “virtual assets” and bring VASPs into the statutory definition of “financial institution.” That matters because AML obligations attach through that financial-institution perimeter. Without that amendment, S.I. 99 of 2026 would not have the same clean footing as a registration regime directed at AML-supervised entities.[1]

The second step is administrative obligation. S.I. 99 of 2026 — the Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 — was gazetted on 10 June 2026 and made by the Minister of Finance under section 103 read with section 3A(1)(a). It converts the statutory status created by the 2025 Act into a registration requirement with the FIU and attaches consequences for operating outside that framework.[1]

That sequence is not a drafting nicety. It prevents a common compliance error: treating the 2025 Finance Act as if it already contained the full VASP registration package, or treating S.I. 99 of 2026 as if it were merely a policy announcement. The first instrument brings VASPs into the AML category; the second tells a captured person what must be filed, paid, maintained, renewed, and disclosed.

Who may be captured as a VASP

The VASP definition is reported as technology-neutral. It is not confined to a conventional exchange with a counter at the front and wallets at the back. Commentary on S.I. 99 notes that the definition can reach persons involved in exchange, transfer, safekeeping, administration, or financial services connected with virtual assets, depending on the activity performed.[1]

The more easily missed point is decentralized finance. The materials do not support a broad statement that every DeFi protocol is automatically a Zimbabwean VASP. They do support a narrower and more useful compliance rule: DeFi actors may be treated as VASPs where they retain control-like powers, including the ability to adjust smart contracts, route funds, or set fees.[1][3]

For intake purposes, the first question should not be whether the business calls itself an exchange, wallet, broker, protocol, or infrastructure provider. The first question is what function it performs and who can change the economic or technical conditions under which customer value moves.

What the FIU registration package requires

S.I. 99 is most useful when read as a file-building regulation. The requirements described in the available legal analysis are the kind that determine whether a compliance team can assemble an application or must first restructure the applicant’s local presence, governance, or AML controls.

The fee position is modest in amount but precise in legal effect. The reported registration fee is US$500, the annual renewal fee is US$400, and no separate application fee is reported. The fees are described as non-refundable and recoverable as debts due to the Reserve Bank of Zimbabwe.[1][4]

The local-presence requirements are more consequential than the headline fees. A foreign operator that can pay US$500 tomorrow still does not have a complete filing if it lacks local incorporation, a registered place of business, two resident directors, or a resident money-laundering compliance officer. Those are structural facts, not forms to be printed at the end of the week.[1][4]

Ongoing AML duties after registration

Registration starts the supervised relationship; it does not exhaust it. The reported duties include customer due diligence at a US$1,000 threshold, additional ownership proof for unhosted wallets above US$1,000, Travel Rule data transmission, five-year record retention, and prescribed notifications to the FIU for changes in the business.[1][4]

The unhosted-wallet rule is worth keeping separate from ordinary CDD in internal notes. It asks for proof tied to control of a wallet, not merely collection of a customer’s name or address. The examples reported — cryptographic signature or “Satoshi test” — are methods for demonstrating control of the relevant address, not general permission to deal with all self-custody wallets.[1]

The notification duties are also easy to understate. A 48-hour material-change notice is a live governance obligation. It is relevant when directors change, ownership shifts, control arrangements move, systems materially change, or the facts on which the registration was granted are no longer the same. A seven-day premises-change notice belongs in the same compliance calendar as licence renewals and corporate-secretarial filings, not in a general policy manual that no one reviews.

What happens if the firm does not register or stops meeting the conditions

The enforcement provisions follow from the registration obligation. Available analysis of S.I. 99 identifies criminal liability for operating unregistered, grounds for suspension or revocation, and penalties up to US$50,000 for governance breaches.[1]

That enforcement exposure should be read with the filing duties above. A VASP that never enters the register faces the most basic unregistered-operation risk. A registered VASP that later fails fit-and-proper, governance, notification, recordkeeping, or AML-control requirements has a different problem: the continued conditions of registration may no longer be satisfied.

What registration does not grant

The safest sentence in the file is the FIU’s own clarification: registration “does not, in itself, constitute authorization to carry on business in Zimbabwe.”[2] That sentence should sit next to any client note, procurement memo, product launch checklist, or board paper using the words “registered VASP.”

The distinction is practical. FIU registration places the VASP inside an AML-supervised registration framework. It does not answer whether the same business may operate an exchange, offer payment services, provide investment products, custody client assets, market to Zimbabwean users, or perform another regulated activity. Those questions still require activity-by-activity review, including with the RBZ or SECZim where applicable.[2][5]

For “Zimbabwe cryptocurrency regulations 2025,” the usable answer is therefore not that Zimbabwe has simply legalized or banned crypto. The record shows an AML classification in 2025, a VASP registration instrument in 2026, a defined application and renewal package, quantified AML duties, and enforcement consequences. It also shows the boundary of the regime: FIU registration is an AML status, not market authorization.

References

1. Zimbabwe Regulates Virtual Asset Service Providers: Key Implications of S.I. 99 of 2026 for Businesses, Investors and Fintech Operators, MM Law
2. Zimbabwe government finally regulates cryptos, exchanges now required to register with RBZ, Techzim
3. Zimbabwe Crypto Regulation SI 99 2026 Guide, Cryptoverse Lawyers
4. Zimbabwe Brings Crypto Firms Under Formal Oversight, BitKE
5. Zimbabwe Crypto Regulation: Bitcoin Treasury Economy, Cryptonews