Rwandan fintechs use SMS for three jobs: one-time passwords at sign-up and login, transaction receipts that BNR's consumer-protection regulation expects for every transaction, and service notices such as loan decisions, fee changes and complaint updates. These are service messages, which RURA's commercial-communication rules exclude, so they can go out at any hour; product offers are commercial and must respect consent, an opt-out and the 19:00 to 07:00 ban.
Last reviewed: 27 October 2026. This article summarises BNR's consumer-protection booklet and RURA's regulation. It is not legal advice; confirm how the rules apply to your licence with BNR.
The rules in one place
Financial service providers supervised by the National Bank of Rwanda (BNR) fall under Law No 017/2021 on financial service consumer protection, implemented by Regulation No 55/2022 on consumer protection and Regulation No 56/2022 on internal complaints handling. BNR's consumer-protection booklet summarises the provisions. The ones that turn into SMS are below.
| Provision (as summarised by BNR) | Source | SMS to send |
|---|---|---|
| Notify the consumer of every transaction; for electronic transactions the consumer chooses SMS, email or both | Reg 55/2022, Art 22 | Transaction receipt |
| Give a key facts statement with tariffs and fees before providing a service | Reg 55/2022, Art 49 | Link to the key facts statement at sign-up |
| Publish fees and upload them to BNR's GERERANYA price comparator | Reg 55/2022, Arts 28 and 29 | Link to your published tariff in fee messages |
| Notify loan approval within two working days; give reasons for a denial within two days | Reg 55/2022, Art 32 | Loan decision message |
| Give at least 30 days' notice of contract changes, with reasons and start date | Reg 55/2022, Art 52 | Change-of-terms notice |
| Mobile money: where money is debited but the beneficiary has not received it, the sender contacts the provider and requests a refund within 6 hours | Reg 55/2022, Art 57 | Failed-transfer message with a contact route |
| Refund within 15 days where fraud is caused by the provider | Reg 55/2022, Art 92 | Refund confirmation |
| Acknowledge a complaint within one working day with a unique tracking code; respond within 15 days with updates every 5 days, through the channel used to complain | Reg 56/2022 | Acknowledgement, progress and outcome messages |
The booklet is a summary, so read the regulation for exact wording. The direction is clear, though: a customer should never have to guess what happened on their account.
Where RURA's rules fit
RURA's Regulation No 001/R/STD-CMR/RURA/018 governs unsolicited commercial communications. Article 4 excludes messages whose primary purpose is to complete or confirm a commercial transaction the recipient agreed to, or to notify a change in account balance or status. Receipts, OTPs and loan decisions therefore sit outside it. A message that offers a new loan, a cashback promotion or a savings product is commercial: it must identify the sender and the source of the recipient's data (Article 7), carry a free opt-out that is honoured within 24 hours (Articles 9 to 12) and must not be sent between 19:00 and 07:00 unless the customer explicitly agreed (Article 15). Keep the two kinds on separate templates, and ideally separate lists, so a marketing pause never delays a receipt.
OTP: design for trust and speed
OTPs are the messages customers notice most when they fail. A few design choices make a measurable difference to support tickets, even though we cannot promise a particular delivery rate:
- Use a registered alphanumeric sender ID. MTN Rwanda requires pre-registration and does not allow dynamic sender IDs; Airtel registration is separate. Allow about three weeks.
- Put the code first and the brand in the text. Customers read the notification preview, not the full message.
- Warn against sharing. BNR's booklet tells consumers to be wary of anyone who calls or texts asking them to act on their account. Your OTP should say you will never ask for the code.
- Short expiry, limited retries. Five to ten minutes and a resend cooldown stop customers from receiving three codes at once.
- Keep it one segment. Plain English or Kinyarwanda, no emoji, under 160 characters.
482913 is your Kivuno Pay code. It expires in 5 min. Kivuno Pay will never call or text to ask for this code. Do not share it.
eSMS Verify handles generation, sending, expiry, rate limiting and checking for you, so codes never sit in your database:
POST https://sms.esmsafrica.io/v1/verify/start
Authorization: Bearer esms_live_...
{"to": "+250788123456", "app_id": "vera_..."}
POST https://sms.esmsafrica.io/v1/verify/check
Authorization: Bearer esms_live_...
{"verification_id": "...", "code": "482913"}
See the Verify documentation and our general guide to sending OTP SMS.
Transaction receipts customers can match
Most Rwandan customers move money through MTN MoMo or Airtel Money, so they compare your SMS with the wallet message they also receive. Use the same amount format, name the channel, and give a reference they can quote to support. Mask account and wallet numbers.
Kivuno Pay: RWF {{amount}} sent to {{payee}} via MTN MoMo {{date}} {{time}}. Fee RWF {{fee}}. Ref {{ref}}. Not you? Call 0788000000
Kivuno Pay: your transfer of RWF {{amount}} to {{payee}} did not complete. Call 0788000000 or open the app now, quoting ref {{ref}}.
The second message matters because of Article 57: when money leaves the wallet but does not arrive, the customer is expected to contact you quickly. An immediate SMS with the reference and a phone number makes that possible.
Loan decisions, fee changes and complaints
Kivuno Loans: your loan of RWF {{amount}} is approved. First instalment RWF {{inst}} due {{date}}. Key facts: go.esmsafrica.io/imkfs
Kivuno Loans: we could not approve your application {{ref}}. Reason: {{reason}}. Advice and appeal: 0788000000
Kivuno Pay: from {{date}} the fee for {{service}} changes to RWF {{fee}}. Details: go.esmsafrica.io/imfee. You may close your account free.
Kivuno Pay: complaint received {{date}}. Tracking code {{code}}. Update by {{date2}}, full reply within 15 days.
Schedule the complaint progress messages from your ticketing system every five days until the case closes. If the customer complained by SMS, reply by SMS; if they used WhatsApp or email, reply there, and use SMS only as a notification.
Promotions without breaking the rules
A promotional message to an existing customer still needs their consent and an opt-out. Standard A2P sender IDs in Rwanda cannot receive replies, so "reply STOP" does not work: give an opt-out link, a USSD menu option in your own app, or a two-way number. Our guide to handling STOP without replies shows how to wire a link to the eSMS opt-out list, which then blocks future sends to that number.
Kivuno Pay: 0 fee on bill payments this weekend. You get this as an Kivuno Pay customer who opted in. Stop offers: go.esmsafrica.io/imstop
Data protection
Customer data falls under Law No 058/2021. Register with the NCSA, store personal data in Rwanda unless your registration certificate authorises otherwise (Article 50), notify the NCSA within 48 hours of a breach, and respect the right to object to direct marketing (Article 19). Our article on Rwanda's data protection law and SMS goes further.
Costs
Receipts and OTPs are usually your highest-volume traffic, so keep them to one segment. A one-segment SMS to Rwanda is RWF 21 ($0.0142) at the basic tier and RWF 10 at the enterprise tier. Sender ID registration is a one-time USD 100 covering MTN and Airtel. See the pricing page for live rates.
Launch checklist
- Sender ID registered on MTN and Airtel; test traffic sent on both networks.
- Customer channel choice (SMS, email or both) stored per account for Article 22.
- Receipts sent from the ledger event, with idempotency so a retry never sends two.
- Failed-transfer, loan-decision, fee-change and complaint templates approved by compliance.
- Promotions on a separate list, scheduled 07:00 to 19:00, with a link-based opt-out.
- Delivery-report webhook monitored; failed OTPs alert the on-call engineer.
Frequently asked questions
Can we send receipts and OTPs at night?
Yes. RURA's 19:00 to 07:00 ban applies to commercial communications, and Article 4 excludes transaction confirmations and account notices. A customer paying at 22:00 should get the receipt at 22:00.
Does BNR require SMS specifically?
Article 22 of Regulation 55/2022, as summarised by BNR, lets the customer choose SMS, email or both for electronic transactions. Many customers choose SMS because it works on any phone, so you need it available.
Should OTPs and promotions share a sender ID?
Better not. Separate sender IDs keep customers from ignoring your codes as marketing and let you pause promotions without touching OTPs. Each is registered separately on MTN and Airtel.
How do we test without sending real SMS?
Use a test key beginning esms_test_. It simulates sends and delivery reports without charge, so you can build the whole flow before going live.
Sources
- BNR - Financial consumer protection booklet (Law 017/2021, Regulations 55/2022 and 56/2022) (PDF)
- BNR - GERERANYA price comparator
- RURA - Regulation governing unsolicited commercial communications (PDF)
- DLA Piper - Data protection laws of Rwanda (Law No 058/2021)
- Telerivet - Rwanda sender ID registration and A2P replies
- eSMS Africa - Verify documentation
See templates for wallets, lenders and payment apps on our page for mobile money and fintech SMS in Rwanda, compare with member alerts for District SACCOs, check sender ID registration in Rwanda, and open an account to start with a free test key.
