BNR Cloud Outsourcing Requirements - Rwanda Banking and Insurance Cloud Compliance
The National Bank of Rwanda (BNR) regulates how the banks, insurers and other financial institutions it supervises outsource technology, including cloud infrastructure. BNR requires prior approval for material outsourcing, retained oversight, audit access for the institution and for BNR, and encryption keys held by the institution. Rwanda's data protection law adds that personal data is stored in Rwanda.
Regulation
BNR Rwanda
Authority
National Bank of Rwanda (BNR)
In effect
2022 (Regulations 49/2022 on outsourcing and 50/2022 on cyber security)
Who this regulation applies to
Every institution BNR licenses and supervises: banks, insurers, microfinance institutions, pension schemes, payment service providers, and financial holding companies operating in Rwanda.
Enforced by: National Bank of Rwanda (BNR) and the Rwanda Data Protection Authority
Key requirements - and how Gewape Cloud Infrastructure addresses them
What the BNR Rwanda mandates, and the specific infrastructure controls Gewape Cloud Infrastructure provides in response.
Personal data is stored in Rwanda
Rwanda's data protection law (Law 058/2021, Article 50) requires personal data to be stored in Rwanda unless the controller or processor holds a certificate from the supervisory authority authorising storage abroad. BNR also requires institutions to know where a provider's primary and backup sites are, and to tell BNR if an overseas authority seeks access to their data.
How Gewape Cloud addresses this
Gewape Cloud Infrastructure scopes Rwanda deployments around Kigali and Huye placement requirements. The written scope should confirm where production data, backups, logs, snapshots, support copies, and DR copies are stored and processed.
Retained oversight and right to audit
BNR requires financial institutions to maintain oversight of outsourced functions. The outsourcing agreement must let the institution audit the provider, and let BNR or its appointed agent do the same. Copies of audit reports go to BNR every quarter.
How Gewape Cloud addresses this
Gewape Cloud's enterprise agreements include explicit audit rights for customers and their regulators. We maintain operational records, access logs, and security evidence that can be provided to BNR examination teams on request.
Prior BNR approval for material outsourcing
Outsourcing a material activity, such as core banking, policy administration or claims systems, needs BNR approval before the contract is signed, changed or extended. Institutions also keep an outsourcing register, filed with BNR each year, and report adverse developments within 24 hours.
How Gewape Cloud addresses this
Gewape Cloud Infrastructure supports your BNR approval request by providing the technical documentation, security evidence, and contractual terms required for your regulatory submission.
Encryption keys held by the institution
For cloud arrangements, BNR expects the encryption key to be retained by the regulated institution, not by the provider.
How Gewape Cloud addresses this
Keys are created and managed in your own project with the Gewape Cloud Key Management service, in the same region as your data. The written scope documents who can reach them.
Business continuity and disaster recovery requirements
BNR requires financial institutions to have documented and tested business continuity plans for all critical systems, including those hosted in the cloud. Recovery time and recovery point objectives must be defined and demonstrably achievable.
How Gewape Cloud addresses this
Gewape Cloud Infrastructure can scope Rwanda DR patterns using Kigali and Huye placement options. RTO, RPO, restore testing, failover model, exclusions, and service credits should be defined in the customer agreement.
Frequently asked questions
Ready to start your BNR Rwanda compliance review?
Our team works with regulated enterprises through their cloud procurement and compliance process. We provide the documentation, contractual terms, and infrastructure evidence you need.