Banking (Victoria Falls International Financial Services Centre) (Financial Technology) Regulations, 2026

These regulations create a FinTech Lab — a regulatory sandbox — inside the Victoria Falls International Financial Services Centre, run by a new Technology Department under a Head of Department with unusually wide discretion.

Nobody may test or develop fintech in the Lab without a licence from the HoD. Applicants go through a pre-application form to establish eligibility, then submit a business and testing plan; the Department assesses whether the applicant has done proper due diligence on the centre's legal requirements, has the financial and other resources to see the testing through, and is fit and proper. Where eligibility is met, a licence must be granted within 21 days. A rejected applicant must be given reasons and may reapply once the problem is fixed.

What can be tested is broad. Activities already regulated at the centre using different technology, activities regulated elsewhere but not here, and activities likely to become regulated all qualify — as do start-ups that cannot yet meet full requirements but commit to complying progressively. Digital assets including cryptocurrencies, stablecoins, utility tokens and security tokens may be authorised for testing, and security tokens representing ownership, debt or investment interests are treated as securities under the centre's framework.

The technology provisions are unusually specific. Participants may deploy smart contracts and distributed ledger technology provided they are tamper-resistant, and smart contracts executed under these regulations are recognised as enforceable. Payment and digital banking participants must build to open banking standards and global API frameworks. AI and machine learning may be used for credit scoring, robo-advice, risk management, fraud detection and automated trading, but only with documentation explaining how decisions are reached, a named individual accountable for oversight, periodic bias testing, and fallback mechanisms for malfunction. Algorithmic trading and robo-advisory firms must disclose key parameters, risk controls and suitability checks, and give clients a plain-language explanation of how recommendations are generated.

Consumer protection is built in at the point of failure: a participant serving retail clients must carry professional indemnity insurance or a client compensation guarantee. On revocation or withdrawal of a licence, the participant must immediately execute its exit strategy, notify customers of the cessation and their rights to redress, compensate customers who suffered financial loss under the safeguards it proposed at authorisation, discharge all outstanding obligations, and file a final report within 30 days.

Licences run for two years, extendable where the participant shows innovative potential, no significant consumer harm and a clear migration pathway to full licensing. Extension applications are due no later than two months before expiry. The HoD may vary licence terms on seven days' notice, and may suspend or revoke where there is a breach or likely breach, a failure to meet licence obligations, or where the risks of the testing outweigh the benefits.

The framework also allows an express licence for low-risk activities such as payments, RegTech and insurtech, an AI Sandbox Express route processed within 30 business days, recognition of sandbox licences from comparable international financial centres without duplicate licensing, and a graduated licensing path through micro, limited-scope and full licences. Digital asset holding limits are set as a percentage of client assets or assets under management rather than fixed Bitcoin equivalents, and are reviewed and published quarterly.