Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026

1. Title.

2. Interpretation.

3. Principles of Virtual Asset Provider Regulation. PART II Registration

4. Application procedure.

5. Appointment of authorised representative.

6. Approval or rejection of application.

7. Issuance of registration certification.

8. Unregistered providers of virtual asset servicers.

9. Renewal of registration. PART III Obligations of Registrants

10. Registrant general obligations.

11. Fitness and probity.

12. Residence requirement.

13. Duty to notify change of information provided. 1497 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 PART IV Suspension, Revocation, Surrender of Registration Certificate Section

14. Suspension of registration.

15. Surrender of registration.

16. Revocation of registration. PART V Travel Rule

17. Interpretation in part.

18. Obligations of ordering VASP.

19. Obligations of beneficiary VASP.

20. Transfers to unhosted wallets.

21. Customer due diligence obligations of VASPs. PART VI General

22. Register of virtual asset service providers.

23. Fees. First Schedule: Virtual Assets Service Providers Registration (VASPR) Form. Second Schedule: Fees. PART I Preliminary Title

1. These regulations may be cited as the Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026. Interpretation

2. (1) In these regulations— 1498 <!-- page break --> S.I. 99 of 2026 “affiliated entity” in relation to an applicant or registrant means— (a) any holding company or subsidiary of the applicant or registrant or any subsidiary of a holding company of the applicant or registrant; or (b) company or entity in which the applicant or registrant owns or controls, directly or indirectly, 10% or more of the voting securities of such entity, (c) company or entity which owns or controls, directly or indirectly, 10% or more of the voting securities of the applicant or registrant; “applicant” means a legal person applying for registration as a virtual asset service provider; “compliance officer” means an employee of the applicant or registrant responsible for ensuring that the registrant complies with its regulatory requirements and internal policies; “prescribed”, in the expression— (a) “prescribed form” means a form prescribed in the First Schedule; (b) “prescribed fee” means a fee prescribed in the Second Schedule; “principal officer” means the natural person who, regardless of his or her formal title, exercises effective executive authority or controlling influence over the virtual asset service provider’s operations, strategic direction, or compliance with the Act and these regulations; “protocol” means a set of coded rules, procedures, or smart contracts that operate on a distributed ledger or blockchain to automatically govern, execute, or facilitate activities relating to virtual assets without the need for ongoing, transaction-by-transaction human intervention; “registrant” means a legal person who has been registered as a virtual asset service provider; 1499 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 “services relating to virtual assets” bears the meaning assigned to it in section 2 of the Act and, for the purposes of these regulations, a person shall be deemed to be providing a service relating to virtual assets, where that person, as a business or for commercial benefit, exercises control over, or provides the essential means for, the operation of a software protocol, smart contract, decentralised application, or similar technological arrangement that facilitates any of the functions listed in section 2 of the Act for or on behalf of other persons; “significant interest” means, in relation to a virtual asset service provider, a holding of ten per centum (10%) or more of the issued share capital, voting rights, or ownership interest in that virtual asset service provider, whether held directly or indirectly; “virtual asset service provider” or “VASP” means a person providing services relating to virtual assets. (2) For the purpose of the definition of services relating to virtual assets in subsection (1), “control” includes, but is not limited to, the ability, directly or indirectly, to:— (a) initiate, modify, or upgrade the operational logic of the protocol; (b) withdraw or reallocate substantial assets held by or within the protocol; (c) determine or materially change the fees, rewards, or economic parameters of the service; (d) direct or shape the governance decisions of the protocol; or (e) commercially market or represent oneself as the provider or operator of the service. Principles of Virtual Asset Service Provider Regulation

3.  The following principles are the basis for the regulation of VASPs— 1500 <!-- page break --> S.I. 99 of 2026 (a) Market Integrity: regulation ensures fair and transparent operations, reducing fraud and manipulation in digital asset markets; (b) Consumer Protection: safeguards protect users from fraudulent schemes and practices, mismanagement, and loss of funds, building trust in virtual assets; (c) Financial Stability: oversight prevents systemic risks, ensuring that virtual asset activities do not destabilise broader financial systems; (d) Innovation Enablement: clear rules encourage responsible innovation, giving entrepreneurs confidence to build new products and services; (e) Transparency and Accountability: VASPs must disclose operations and risks, fostering accountability to customers and regulators; (f) Risk Management: regulation requires providers to identify, monitor, and mitigate risks such as cyber attacks, liquidity shortages, or operational failures; (g) Global Interoperability: harmonised principles across jurisdictions allow VASPs to operate internationally, supporting cross-border commerce; (h) Trust and Confidence: regulation builds public confidence in digital assets, encouraging adoption and long-term growth. PART II Registration Application procedure

4. (1) Any person wishing to apply for registration as a virtual asset service provider shall make such application in the prescribed Form and submit it together with the prescribed application fee and documentation specified in subsection (2). (2) The documentation required to be submitted together with the application form referred to in subsection (1) shall include— (a) a certified copy of the certificate of incorporation or establishing documents of the applicant; 1501 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (b) certified copies of the identity documents for all beneficial owners, directors, and principal officers of the applicant; (c) proof of residence for all natural persons listed in the application; (d) Zimbabwe Republic Police or equivalent clearance certificates for all beneficial owners, directors, and principal officers of the applicant dated within six months of the application; (e) detailed information on the nature, size, scope, and complexity of the virtual asset service provider; (f) a description of the underlying technology to be used, method of service delivery, and the virtual assets to be utilised; (g) proof of the applicant’s physical business premises and head office address; (h) an ownership structure chart or diagram; (i) the applicant’s valid tax clearance certificate; (j) completed fit and proper declaration forms for all beneficial owners, directors and principal officers of the applicant that speak to all the matters itemised in the Third Schedule; (k) a written entity-specific risk assessment report of the money laundering, terrorist financing, and proliferation financing risks the virtual asset service provider will be exposed to, specifying how those risks are identified, assessed, understood, monitored, mitigated and reported; (l) a written Anti-money laundering/counter financing of terrorism/counter proliferation financing policy demonstrating how the applicant intends to comply with its obligations under the Act and relevant regulations; (m) the name and address of any affiliated entity within and outside of Zimbabwe; (n) the name and qualifications of a proposed compliance officer; 1502 <!-- page break --> S.I. 99 of 2026 (o) policies, tools and procedures for— (i) data protection, security and confidentiality; and (ii) cyber-security safeguards, that is to say, protective measures designed to prevent, detect, and respond to threats against digital systems, networks, and data, thereby ensuring confidentiality, integrity, and availability. (3) An applicant shall be incorporated or registered as a legal entity in Zimbabwe:   Provided that, where the applicant forms part of a multinational group, the applicant shall operate through a subsidiary that is incorporated or registered in Zimbabwe. (4) For the purposes of processing an application for the registration of a virtual asset service provider, the Unit may, in addition to the information provided under subsection (2), require such additional information as it considers appropriate and within such period as the Unit determines. (5) Where the Unit is of the view that, in relation to an application under subsection (1), any information required under subsection (2) or (4) has not been provided, it shall notify the applicant to provide the information within such period as the Unit determines. (6) An application for the registration of a virtual asset service provider under this section which fails to provide all the information required under subsection (2), or any additional information or missing information respectively required under subsection (4) or (5), within the prescribed period, shall be considered as incomplete and abandoned. (7) Where an application is considered as incomplete and abandoned in terms of subsection (6), the Unit shall notify the applicant within ninety days from the date of having received the initial application, that the application has been rejected and the reasons for such rejection. (8) Where an applicant makes a false or misleading declaration in an application or submits false or misleading documents in support of an application— 1503 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (a) the Unit shall use this as a ground for rejecting such application or revoking registration that would have been approved, once the Unit becomes aware; (b) such applicant shall be prohibited from making another application for registration within a period of six months from the date of rejection or revocation of registration; (c) such applicant commits an offence and shall be liable to a fine not exceeding ten thousand United States dollars. (9) The Unit shall determine an application and notify the applicant in writing of its decision within ninety days from the date of receiving a complete application. Appointment of authorised representative

5. A registrant referred to in the proviso to section 4(3) must appoint an authorised representative in Zimbabwe to whom requirements of section 11 in relation to a fit and proper person shall apply at the time of registration, and if any other such representative is appointed after such time, the registrant shall promptly (and in any event no later than 14 days of such appointment), submit to the Unit a fit and proper person declaration relating to that appointee. Approval or rejection of application

6. (1) The Unit may approve an application for the registration of a virtual asset service provider if it is satisfied that— (a) the applicant meets the prescribed requirements to be registered as a virtual asset service provider; (b) the applicant intends, if registered as a virtual asset service provider, to carry on the business for which it is to be registered; (c) the proposed virtual asset service provider and its principal officers and persons with a significant interest in the business meet the fit and proper criteria outlined in section 11; (d) the applicant, if registered as a virtual asset service provider, has or will have the ability and capacity to manage and mitigate the risks of engaging in the virtual 1504 <!-- page break --> S.I. 99 of 2026 asset service provider’s business activities, including activities that involve the use of anonymity-enhancing technologies or mechanisms (such as mixers, tumblers and similar technologies) that obfuscate the identity of the sender, recipient, holder or beneficial owner of a virtual asset; and (e) registering the virtual asset service provider is not against public interest. (2) Without limiting subsection (1), the Unit may refuse to register an applicant as a virtual asset service provider if it forms the opinion that a person having a share or other interest in the applicant, whether significant, controlling or otherwise or legal or equitable, does not satisfy the fit and proper criteria section 11. (3) Where the Unit does not approve an application under subsection (1) or (2) for registration as a virtual asset service provider, it shall inform the applicant in writing giving the Unit’s reason for the refusal. Issuance of registration certification

7. (1) Where the Unit approves an application for registration under section 6(1), it shall notify the applicant in writing and, upon payment of the prescribed issuance fee— (a) allocate a unique registration number to the applicant; (b) register the applicant and issue a certificate of registration in such form as it considers appropriate; (c) enter the applicant’s details into the Register of virtual asset service providers maintained under section 21; (d) the Unit may impose conditions on the registration as it considers appropriate, which shall be recorded in the Register against the applicant’s details. (2) A registration certificate issued under this section shall be valid for a period of one year from the date of issuance, unless it has earlier been surrendered, suspended or revoked. (3) A virtual asset service provider may not assign or transfer a registration certificate to any other person, and any such purported assignment or transfer of a virtual asset service provider registration certificate shall be void and of no effect. 1505 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (4) A virtual asset service provider registration certificate shall state the following information— (a) the name and address of the virtual asset service provider; (b) the services that may be provided by the registrant; (c) the unique registration number; and (d) the time period for which the registration is valid. (5) A virtual asset service provider shall prominently display its certificate of registration, in both physical and digital form, at all places where it provides services. Where services are offered online or on physical premises, the certificate shall be accompanied by a QR code that, when scanned, directs users to the official registry entry confirming the provider’s authorisation. Unregistered providers of virtual asset servicers

8. (1) The Unit shall establish and maintain systems, structures and procedures to identify any person who, not being registered— (a) carries on services related to virtual assets, or; (b) purports to carry on services related to virtual assets. (2) Where the Unit identifies any person providing virtual asset services without being registered in terms of subsection (1), the Unit may share such information with any relevant competent authorities or financial institutions. Renewal of registration

9. (1) Any person wishing to renew their registration may make an application for renewal to the Unit, within ninety days prior to the expiration of their existing registration, and submit a completed Compliance Form from the Unit, together with the following— (a) updated fit and proper declarations for all beneficial owners, directors, and principal officers; (b) a current tax clearance certificate; (c) updated proof of the applicant’s physical business premises and head office address; 1506 <!-- page break --> S.I. 99 of 2026 (d) an updated written entity-specific risk assessment for money laundering, terrorist financing, and proliferation financing risks, with associated mitigation policies; (e) prescribed renewal application fee; and (f) any other key information or documentation the Unit may require for the purpose of renewing the registration certificate. (2) Sections 4 and 5 relating to procedure for approval of registration as well as issuance of the certificate of registration shall apply to the renewal process. (3) Any person who submits an application for renewal of registration after expiry of existing registration shall be liable to a fine not exceeding level 6 on the standard scale. PART III Obligations of Registrants Registrant general obligations

10. (1) All persons whose registration is approved pursuant to section 4 shall comply with the following requirements— (a) maintaining beneficial owners and principal officers who are fit and proper person in terms of section 11; (b) appointing a money laundering compliance officer resident in Zimbabwe with the authority and independence to implement and oversee the anti-money laundering/counter financing of terrorism/counter proliferation financing compliance programme; (c) ensuring that the virtual asset service provider has no fewer than two resident directors at all times; (d) notifying the Unit in writing, immediately of any material change in its ownership, control, management, business operations, or compliance status; (e) paying all prescribed fees; (f) taking reasonable steps to ensure that its beneficial owners or any natural person employed by, or associated with, the virtual asset service provider comply with the act, directives and guidance for virtual asset service providers set out by the unit from time to time; and 1507 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (2) Where a registrant has failed to comply with the requirements in subsection (1)(a),(b) and (c) and (f) such registrant shall be liable to a fine not exceeding fifty thousand United States dollars. Fitness and probity

11. (1) In determining whether a person is, for the purposes of these Regulations, a fit and proper person, the Unit may have regard— (a) in respect of the person and, where the person is a company, the officers and beneficial owners of the company, to— (i) the financial standing; (ii) the relevant education, qualifications and experience; (iii) the ability to discharge the relevant functions properly, efficiently, honestly and fairly; (iv) the reputation, character, financial integrity and reliability; and (v) any relevant criminal record; (b) to any matter relating to— (i) any person who is or is to be employed by, or associated with, the person; (ii) any related company of the company and any officer of any related company; (iii) any agent or representative of the person; (c) to any matter specified in the Act or any other applicable legislation relating to the fit and proper person requirement; (d) has been refused a license relating to provision of financial services or had one revoked in Zimbabwe or elsewhere; (e) any other information or any other matter as it deems necessary. (2) Where the Unit determines a person as not fit and proper, the Unit shall notify the applicant in writing and make a determination on the application. 1508 <!-- page break --> S.I. 99 of 2026 Residence requirement

12. (1) Every registrant shall— (a) have a registered office or place of business in Zimbabwe; (b) ensure that all records and documentation required to be kept by the registrant under the Act and Regulations are available and accessible from the office specified under paragraph (a); (c) notify the Unit of any change in the registered office or place of business within seven days after the date of the change. (2) Where a registrant has failed to comply with or no longer complies with the requirements in subsection (1), such registrant shall be liable to a fine not exceeding fifty thousand United States dollars. Duty to notify change of information provided

13. (1) Where, prior to the approval and registration of an application, there is a material change in the information provided to the Unit under section 3, the applicant shall within 48 hours of becoming aware of the material change, notify the Unit of that fact. (2) Where, after the approval and registration of an application, there is a material change in the information provided to the Unit under or any other change which is likely to materially affect the basis on which an applicant was approved and registered, the applicant shall within forty-eight hours of becoming aware of the material change, notify the Unit of that fact indicating— (a) the nature and scope of the change; (b) the reason for, or circumstance that gave rise to, the change; and (c) whether or not the change is likely to materially affect the business of the virtual asset service provider. (3) Where the Unit is notified of any change under subsection (1) or (2), it may issue such directive and exercise such power, including the power to deregister the registered virtual asset service provider, as it considers appropriate, having regard to the submissions of the applicant or registrant. 1509 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (4) Where an applicant, or registrant fails to notify the Unit of any material change, in terms of subsections (1) or (2) respectively, such applicant shall be liable to a fine not exceeding fifty thousand United States dollars. PART IV Suspension, Revocation, Surrender of Registration Certificate Suspension of registration

14. (1) Where the Director General is satisfied on reasonable grounds that it is urgent and necessary to do so for the protection of the interest of the public he may, by notice, suspend the registration of a virtual asset service provider. (2) The Director General shall, subject to subsection (3), not suspend the registration of a virtual asset service provider under subsection (1) unless he gives the virtual asset service provider— (a) prior notice of his intention and the reasons for doing so; and (b) an opportunity to make representations on the matter. (3) A person who receives a notification under subsection (2) may, within seven days after receipt of the notification, submit a written response to the Unit— (a) accepting the suspension; or (b) opposing the Unit’s intention to suspending the registration and giving their reasons for the opposition. (4) Where a person, having received notification for intention to suspend in terms of subsection (2), neither submits a response to the Director General that they accept or oppose the intention to suspend in terms of subsection (3) shall be issued with a Notice of suspension after the lapse of the seven day period. (5) Where the Director General considers that any delay in suspending the registration of a virtual asset service provider may cause prejudice to the public or any part of the financial services industry, he may suspend the registration with immediate effect and shall give the virtual asset service provider the opportunity to make representations as soon as practicable, but not later than seven days from the date the registration is suspended. 1510 <!-- page break --> S.I. 99 of 2026 (6) Where the registration of a virtual asset service provider is suspended, such suspension shall extend to any registration or similar permission held by its agent or representative, as the case may be. (7) Where the registration of a virtual asset service provider is suspended, the virtual asset service provider shall cease to carry out the business activities authorised by the registration, but it shall remain subject to the obligations of a virtual asset service provider and to the directions of the Unit until the suspension of the registration is removed or the registration is revoked. (8) A virtual asset service provider whose registration is suspended may, notwithstanding subsection (5), continue to carry out such activities as the Director General may authorise and on such conditions as the Director General may determine. (9) The Director General shall give public notice of the suspension of the registration of a virtual asset service provider. Surrender of registration

15. (1) A virtual asset service provider may voluntarily surrender its registration by giving written notice to the Unit, and such surrender shall be irrevocable. (2) Where the Unit approves a surrender of registration under subsection (1), it shall notify the virtual asset service provider within fourteen days from the date of receipt of the notice of surrender of business. Revocation of registration

16. (1) The Unit may, subject to subsection (3), revoke a registration issued under section 5 if it is satisfied that the virtual asset service provider— (a) has committed a money laundering, terrorist financing or proliferation financing offence or failed to adhere to its obligations outlined in the Act in a manner considered by the Unit to be sufficiently serious to warrant a revocation of the registration; (b) is no longer able to meet the requirements of the Act or any directive issued by the Unit; 1511 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (c) had, at the time of applying for registration under these regulations, provided information which was materially false or misleading; (d) no longer satisfies any of the conditions upon which its registration was granted; or (e) has contravened a provision of the Act or these Regulations; (f) ceases to operate or offer services related to virtual assets in excess of 30 days; (g) makes a request for revocation or suspension to the Unit; (h) enters liquidation, is wound up or otherwise dissolved; (i) is no longer a fit and proper person to be a registrant; or (j) is conducting business in manner that is detrimental to the public interest. (2) The Unit shall, before revoking a registration notify the registered virtual asset service provider of the Unit’s intention to revoke the registration, stating the grounds for the proposed revocation. (3) A person who receives a notification under subsection (2) may, within seven days after receipt of the notification, submit a written response to the Unit— (a) accepting the revocation; or (b) opposing the Unit’s intention to revoke the registration and giving their reasons for the opposition. (4) Notwithstanding subsection (2) the Unit may revoke registration without notice if it is in the public interest. (5) The notice under subsection (3) shall specify the reasons for the revocation. (6) Where the Unit forms the opinion that any of the matters outlined in subsection (1) is of a grave nature, it may, at the same time as providing the notification under subsection (2), direct the person concerned to suspend any business or activity relating to the provision of services relating to virtual assets, and such directive shall remain in force pending the outcome of the Unit’s decision. 1512 <!-- page break --> S.I. 99 of 2026 PART V Travel Rule Interpretation in part

17. In this Part— “Batch Transfer” means a transfer comprised of a number of individual virtual asset transfers that are being sent to the same virtual asset service provider, but may or may not be ultimately intended for different persons; “IVMS 101” means the Joint Working Group InterVASP Messaging Standard (IVMS) regarding technical data models for Travel Rule compliance or any other internationally accepted interoperability standard in future; “Ordering VASP” means the VASP which initiates the virtual asset transfer and transfers the virtual asset upon receiving the request for the transfer on behalf of the originator. “Travel Rule” means the obligation to obtain, verify, and transmit originator and beneficiary information immediately and securely during a virtual asset transfer. “Unhosted Wallet” (or Self-Hosted Wallet) means a wallet where the private keys are held by a person who is not a VASP or financial institution. “Wallet Ownership Proof” means evidence that a person or entity controls a specific virtual asset wallet address. Obligations of the Ordering VASP

18. (1) For all virtual asset transfers, the Ordering VASP must obtain and hold the following information: (a) Originator Information: (i) full legal name; (ii) virtual asset wallet address or account number; (iii) physical address; or (iv) National Identity number or Passport number; and 1513 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (v) date and place of birth. (b) Beneficiary Information: (i) full legal name; (ii) virtual asset wallet address or account number; and (iii) the name of the country and town/city of the beneficiary’s residence. (2) The Ordering VASP must verify the accuracy of the Originator Information using independent and reliable source documents, data, or information (KYC) before the transfer is executed. (3) Once the information is verified, the Ordering VASP must immediately and securely send the information to the beneficiary VASP. Obligations of the Beneficiary VASP

19. (1) A Beneficiary VASP must have effective risk-based procedures to identify virtual asset transfers that lack the required originator or beneficiary information. (2) Upon receipt of the information, the Beneficiary VASP must: (a) verify the identity of the Beneficiary (its own client) against its own records; and (b) determine whether the information received matches the beneficiary information it holds. Transfers to unhosted wallets

20. (1) Where a transfer is made to an unhosted wallet (P2P), the Ordering VASP must— (a) obtain the required Beneficiary Information from its own client (the Originator); and (b) conduct Wallet Ownership Proof (e.g., “Satoshi Test” or cryptographic signature) to verify that the unhosted wallet is owned or controlled by the client, for any transaction exceeding USD1 000,00. (2) The Ordering VASP must apply enhanced monitoring to transactions involving unhosted wallets to detect potential sanctions evasion. 1514 <!-- page break --> S.I. 99 of 2026 (3)  This provision is additional to and does not substitute for the general customer due diligence provision contained in section 19 below. Customer due diligence obligations of VASPs

21. (1) This section shall apply to all transactions, whether single or linked, conducted by a VASP equal to or exceeding USD 1,000 or its equivalent in other currencies. (2) The following are Identification and Verification obligations of VASPs— (a) a VASP shall identify and verify the identity of each customer using reliable, independent source documents, data, or information; and (b) where the customer acts on behalf of another person, the VASP shall identify and verify the beneficial owner; and (c) the VASP shall obtain information on the purpose and intended nature of the business relationship. (3) The following are Ongoing Monitoring obligations of VASPs— (a) a VASP shall conduct ongoing monitoring of transactions to ensure consistency with the customer’s profile and risk level; and (b) enhanced due diligence shall be applied to higher risk customers, jurisdictions, or transaction patterns; (c) customer information shall be kept current and reverified periodically. (4) The following are RecordKeeping obligations of VASPs— (a) a VASP shall retain all identification documents, verification data, and transaction records for a minimum of five years after the cessation of the business relationship; and (b) records shall be readily available to competent authorities upon request. 1515 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 (5) The following are Suspicious Activity Reporting obligations of VASPs— (a) a VASP shall promptly file a Suspicious Transaction Report with the designated authority upon detection of unusual or suspicious activity; and (b) staff shall be trained to recognize redflag indicators of money laundering, terrorist financing, or other illicit activity. (6) The following are Compliance and Oversight obligations of VASPs— (a) each VASP shall establish internal policies, procedures, and controls to implement customer due diligence effectively; and (b) the compliance officer shall be designated with responsibility for oversight and reporting; and (c) systems shall be subject to independent audit and regulatory review. PART VI General Register of virtual asset service providers

22. (1) The Unit shall establish and maintain a register of virtual asset service providers to be known as the Register of Virtual Asset Service Providers. (2) The Register shall categorise virtual asset service providers according to their authorised services relating to virtual assets. (3) The Register shall be published and regularly updated on the Unit’s website. (4) The Register must contain all of the following information in respect of every registrant— (a) the full name of the registrant; (b) the category of registration certificate issued and any conditions imposed on the registration; (c) the virtual asset services provided by the registrant; 1516 <!-- page break --> S.I. 99 of 2026 (d) the registered office or place of business of the registrant; (e) the date on which the registration certificate was issued; (f) the expiry date of the registration certificate, if any; (g) the full name and physical address of the principal contact person or persons; and (h) any other relevant information which the Unit considers necessary. (5) The Unit must ensure that the Register referred to subsection (1) is open to the public for inspection during office hours and copies of the Register must on request by any person be made available to that person for a prescribed fee. Fees

23. (1) Any fees paid pursuant to these Regulations shall not be refundable. (2) The registration fee prescribed in the Second Schedule shall be paid to the Unit and shall be in respect of a period of twelve months. (3) All fees paid shall accrue to the funds of the Reserve Bank and shall form part of such funds. (4) Any fee, charge or penalty that is owed to the Unit under these Regulations may be recovered as a debt due to the Reserve Bank of Zimbabwe. 1517 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 First Schedule (Section 4(1)) VASPR FORM VIRTUAL ASSETS SERVICE PROVIDERS REGISTRATION FORM APPLICATION FOR REGISTRATION AS A VIRTUAL ASSET SERVICE PROVIDER Instructions on how to complete this form. • Attach annexures wherever necessary. • Do not leave any questions blank or unanswered: where necessary answer “Not applicable” or “Not known” . • All responses in this form and all annexures shall be typewritten. • Upon completion the form and supporting annexures shall be submitted to the following email address:------ • All inquiries concerning this form should be directed to ------. PRELIMINARY State the name, address and telephone number(s) of the contact person for purposes: ............................................................................................................................. ............................................................................................................................. ............................................................................................................................. PART A: APPLICANT INFORMATION Section 1: Applicant’s details

1. Legal Name of Applicant

2. Type of legal entity (for example a partnership, or company etc)

3. Date of incorporation/establishment

4. Company registration number

5. Tax Identification Number (TIN)

6. Country of primary incorporation or establishment 1518 <!-- page break --> S.I. 99 of 2026

7. Physical Address (Registered Office)

8. Email Address

9. Telephone Number Attach a certified copy of the Applicant’s Certificate of Incorporation, or similar establishing document, tax clearance certificate and proof of the business’s physical address. Section 2: Proposed virtual asset services to be offered Tick where appropriate a. Exchange between virtual assets and fiat currencies b. Exchange between one or more forms of virtual assets c. Transfer of virtual assets d. Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets e. Participation in and provision of financial services related to virtual asset issuance or sale f. Other (specify): ______________________________________________________ PART B: BENEFICIAL OWNERSHIP AND CONTROL STRUCTURE Section 1: Persons with significant interest in the virtual asset service provider Complete the table for each natural person who holds, directly or indirectly, 10% or more of shares, voting rights, or ownership interest in the virtual asset service provider. Include beneficial owners behind any intermediate structures. 1519 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 If indirect, National Direct or specify the identity number/ % of indirect chain of No. Full name Nationality passport number interest control ownership* 1. 2. 3. 4. 5. Attach certified copies of identification documents (passport/national ID) and proof of residence for each person listed above. *Note: “Indirect control” includes holdings through legal persons, trusts, or other arrangements. Describe the full chain of ownership/control until the ultimate natural person (beneficial owner) is identified. Section 2: Principal Officers of the virtual asset service provider Complete for each natural person who exercises de facto executive authority or controlling influence over operations, strategic direction, or anti-money laundering/counter financing of terrorism/counter proliferation financing compliance, regardless of formal title. National Identity number/ No. Full name Position passport number Place of residence 1. 2. 3. 4. 5. For each Principal Officer listed, attach certified copy of identification document and proof of residence. 1520 <!-- page break --> S.I. 99 of 2026 PART C: FIT AND PROPER PERSON DECLARATION To be completed by each person identified in Part B above. Submit separate forms for each individual. DECLARANT’S INFORMATION Full Name ID/Passport Number Capacity in relation to Applicant (e.g. Director, 10% Shareholder) Name of Applicant virtual asset service provider Declarations – Please tick () ONE box per question Declaration Yes No If YES, provide full details on attached sheet Have you ever been convicted, in Attach details: Zimbabwe or elsewhere, of a serious o f f e n c e , offence? jurisdiction, date, penalty Have you ever been convicted, in Attach details: Zimbabwe or elsewhere, of any offence o f f e n c e , involving fraud, dishonesty, perjury, jurisdiction, or conspiracy to pervert the course of date, penalty justice? Have you ever been subject to any regulatory sanction, investigation, or Attach details: disqualification by a financial services regulator, nature regulator in Zimbabwe or elsewhere? of action, date, outcome Have you ever been declared insolvent Attach details: or bankrupt? jurisdiction, d a t e , c u r re n t status Have you ever been disqualified or Attach details: restricted in Zimbabwe or elsewhere reasons for from acting as a director of a company? disqualification, jurisdiction, date 1521 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 Are you currently involved in any Attach details: business or activity that could conflict nature of with your responsibilities to this virtual business/activity asset service provider or compromise and potential your integrity? conflict Affirmative Undertakings – Please tick () ALL that apply Undertaking Tick () I understand and commit to ensuring the virtual asset service provider’s compliance with the Money Laundering and Proceeds of Crime Act and all related ANTI-MONEY LAUNDERING/ COUNTER FINANCING OF TERRORISM/ COUNTER PROLIFERATION FINANCING laws. I am aware of my personal responsibility to prevent the virtual asset service provider from being used for money laundering, terrorist financing, or proliferation financing. I have disclosed to the virtual asset service provider all actual or potential conflicts of interest arising from my position or other interests. I authorise the Financial Intelligence Unit to:

1. Conduct background checks on me, including criminal record and regulatory history checks.

2. Verify any information I have provided in this declaration.

3. Share this information with other regulatory, law enforcement, or supervisory authorities as necessary for lawful purposes. I understand that providing false, incomplete, or misleading information in this declaration may result in refusal or revocation of the virtual asset service provider’s registration and may lead to possible criminal prosecution. Signature Date ___________________________ ____________ Witness: Name:________________________________________ Signature:_____________________________________ Date: _________________________________________ 1522 <!-- page break --> S.I. 99 of 2026 PART D: DECLARATION BY APPLICANT We, ____________________________________________________, (Legal Name of Applicant) represented by __________________________________________, (Name of Authorised Representative) in the capacity of ________________________________________, (Position) hereby:

1. Declare that all information provided in this form and accompanying documents is true, complete, and accurate.

2. Undertake to immediately notify the Financial Intelligence Unit of any material change to this information.

3. Acknowledge that providing false or misleading information is an offence and may result in refusal or revocation of registration. For and on behalf of the Applicant Name: __________________________ Signature: _______________________ Date: ___________________________ PART E: CHECKLIST OF REQUIRED DOCUMENTS Tick each box to confirm attachment: Part A & B documents: • Certified copy of Certificate of Incorporation/establishing documents • Proof of applicant’s physical business premises • Ownership structure chart/diagram • Certified ID copies for all persons in Part B • Proof of residence of all persons listed in Part B • Zimbabwe Republic Police or equivalent clearance certificates for all persons listed in Part B dated within 6 months of the application • Applicant’s up to date tax clearance certificate General: • information on the nature, size, scope and complexity of the virtual asset service provider, the underlying technology intended to be used, 1523 <!-- page break --> Money Laundering and Proceeds of Crime (Virtual Asset Service Providers Registration) Regulations, 2026 method of delivery of the virtual asset service and the virtual assets to be utilised • proof of source of funds • a written assessment of the money laundering, terrorist financing, and proliferation financing risks the virtual asset service provider will or may be exposed to • a written anti-money laundering/counter financing of terrorism/ counter proliferation financing policy • proof of payment of registration fee • the name and address of any affiliated company within and outside of Zimbabwe • policies and procedures for data protection, security and confidentiality • documented cyber-security safeguards which are to be put in place • any other documents specifically requested by the Unit Advice completing the declaration • Attach annexures wherever necessary. • Do not leave any questions blank or unanswered: where necessary answer “Not applicable” or “Not known”. • All responses in this form and all annexures must be typewritten, digitally filled or computer-types. • Intentionally leaving out or misrepresenting details may disqualify you from your role. Second Schedule (Sections 3, 4(7), 6(1) and 6(2)) Process Fee US$ Application fee None Registration issuance fee 500 Registration renewal fee 400 Supplement to the Zimbabwean Government Gazette Extraordinary dated the 10th June, 2026. Printed by the Government Printer, Harare. 1524 <!-- page break -->