Introduction
On 22nd July 2026, the Cabinet Secretary for the National Treasury gazetted the Virtual Asset Service Providers Regulations, 2026 (the “Regulations“), thereby giving full operational effect to the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025). The Regulations establish Kenya’s first comprehensive licensing and supervisory regime for Virtual Asset Service Providers (“VASPs“). For existing operators and prospective entrants, compliance is no longer optional; the regulatory window is now firmly open.
Scope of Application
The Regulations apply to all persons offering virtual asset services “in or from Kenya.” Significantly, a person is deemed to operate in or from Kenya where they actively solicit or target local consumers or derive economic benefit from Kenya, regardless of whether they maintain a physical presence in the country. This extraterritorial reach means that foreign-based platforms serving Kenyan consumers must carefully assess their licensing obligations.
The Dual-Regulator Model
The Regulations preserve the dual-regulator architecture established under the Act. The Central Bank of Kenya (“CBK“) supervises Virtual Asset Wallet Providers, Virtual Asset Payment Processors, and Stablecoin Issuers, while the Capital Markets Authority (“CMA“) regulates Virtual Asset Exchanges, Brokers, Investment Advisors, Managers, Initial Coin Offering (“ICO“) Providers, Virtual Asset Tokenisation activities, and Token Issuance Platforms. In total, there are ten distinct licence categories, each with specific application requirements, ongoing obligations, and supervisory expectations.
Licensing Requirements
|
Requirement |
Executive summary |
|
Application package |
Applicants must provide director, officer, shareholder and beneficial-owner details; a business plan; fit and proper documentation; proof of source of funds; and core operational policies covering AML/CFT/CPF, data protection, cybersecurity, complaints, consumer protection, conflicts and business continuity. |
|
Financial and technology evidence |
Applicants must submit audited financial statements or opening statements, an independent information-systems audit, vulnerability assessment and penetration testing report, and disclosure of any cross-border operations. |
|
Market-facing platforms |
Exchanges and token issuance platforms must provide business rules addressing market integrity, order matching, settlement and dispute resolution. |
|
Regulatory timeline |
The relevant regulator must determine a complete application within thirty (30) days. |
An applicant must submit a comprehensive application to the relevant regulator, including personal details of directors, senior officers, significant shareholders and beneficial owners; a business plan; fit and proper assessments; proof of source of funds; and operational policies covering AML/CFT/CPF, data protection, cybersecurity, complaints management, consumer protection, conflict of interest, and business continuity. Audited financial statements (or opening statements for new entities), an independent information systems audit report including vulnerability assessment and penetration testing, and full disclosure of cross-border operations are also required. For exchanges and token issuance platforms, the application must include detailed business rules covering market integrity, order matching, settlement, and dispute resolution. The regulator must determine a complete application within thirty (30) days.
Capital and Financial Requirements
Application fees range from KES 10,000 for a Virtual Assets Investment Advisor to KES 100,000 for most other categories, while licence fees span from KES 50,000 for an Investment Advisor to KES 2,000,000 for a Stablecoin Issuer. Renewal fees are similarly calibrated: some attract fixed amounts, while others are calculated as a percentage of gross turnover, gross revenue, or assets under management, subject to prescribed minimums and maximums.
On the capital front, minimum paid-up capital requirements range from KES 10,000,000 for Brokers, Payment Processors, ICO Providers, and Token Issuance Platforms, through to KES 20,000,000 for Managers and Tokenisation activities, KES 100,000,000 for Exchanges, and KES 150,000,000 for Wallet Providers, up to KES 300,000,000 for Stablecoin Issuers. Liquid capital requirements are also prescribed, generally requiring either a fixed minimum or a percentage of total liabilities, whichever is higher. Where a licensee holds multiple licences, it must maintain the capital applicable to the highest-capital category plus 50% of the paid-up capital for each additional activity.
Stablecoin Issuance
Stablecoin issuers face the most stringent prudential requirements. They must fully back outstanding stablecoins with reserve assets of at least equivalent nominal value, held in segregated pools comprising cash, short-dated government securities, repurchase agreements, or other CBK-approved assets. Reserve assets must be legally segregated from the issuer’s estate and from other stablecoins. Holders enjoy a statutory right to redeem at par value within two working days, and issuers are prohibited from granting interest. Quarterly stress testing and independent reserve audits are mandatory, with monthly reporting to the CBK on circulation, transaction volumes, and any de-pegging events.
Tokenisation and Initial Coin Offerings
The Regulations introduce a dedicated framework for the tokenisation of real-world assets (“RWA”). Applicants must demonstrate clear legal rights to the underlying asset, obtain an independent valuer’s report, prove the asset is free of encumbrances, and code ownership, transferability, and profit distribution rules into smart contracts. ICO issuers must likewise obtain CMA approval and publish a comprehensive white paper before any offer or promotion, with approvals valid for up to twelve months.
Consumer Protection and Custody Obligations
Consumer protection is woven throughout the framework. Licensees must segregate consumer assets from their own holdings, maintain separate accounts, and refrain from lending, pledging, or otherwise encumbering consumer assets. Monthly reconciliations of on-chain holdings against internal records are required, and consumers must receive quarterly statements of their holdings. At the point of service, licensees must provide clear disclosures on licence status, fees, risks, and complaint procedures, and must ensure that any investment recommendation is suitable for the consumer’s circumstances.
Cybersecurity and Operational Resilience
On the operational side, licensees must appoint a chief information security officer or equivalent, conduct bi-annual vulnerability assessments and penetration testing in the first year and at least annually thereafter, and maintain comprehensive audit trail systems capable of reconstructing all transactions. Business continuity and incident response plans must be tested annually and submitted to the regulator, while cybersecurity incidents must be reported within twenty-four hours, with detailed follow-up reports due within five working days.
The Coordination Forum
The Regulations establish the “Virtual Assets Services Coordination Forum”, comprising representatives from 20 agencies including the National Treasury (Chair), CBK, CMA, Asset Recovery Agency, Financial Reporting Centre, and Office of the Data Protection Commissioner. The Forum will facilitate information sharing, harmonise cross-sectoral approaches, and support risk assessments.
Enforcement and Penalties
The enforcement framework is robust. Administrative sanctions include fines of up to KES 3 million for individuals and KES 5 million for companies, alongside suspension or revocation of licences. Criminal liability attaches to market conduct offences such as insider trading, market manipulation, front-running, and failure to comply with freezing or seizure orders, with penalties extending to fines of up to KES 5 million or imprisonment for up to five years for individuals, and fines of up to KES 8 million for companies.
What This Means for You
Immediate action: Existing VASPs should complete a licence-mapping and regulatory perimeter assessment, identify whether CBK or CMA approval is required, and begin preparing the application file ahead of the 4th November 2026 deadline.
Prospective entrants: Applicants should prioritise governance, capital planning, AML/CFT/CPF controls, cybersecurity testing, data protection, consumer disclosures and business-continuity documentation before submission.
Cross-border providers: Foreign platforms targeting Kenyan consumers or deriving economic benefit from Kenya should urgently assess whether their activities trigger local licensing obligations despite the absence of a physical presence.
Investor and consumer diligence: Investors and consumers should verify licensing status, review risk disclosures and confirm complaint-handling channels before engaging a VASP.
Conclusion
For existing VASPs, the compliance clock is ticking. The Act provides existing operators with one year from its commencement on 4th November 2025 to obtain a licence, making 4th November 2026 a hard deadline. New entrants must secure a licence before commencing operations. Foreign providers targeting Kenyan consumers should likewise evaluate their obligations without delay. We anticipate that the CBK and CMA will issue further implementation guidance in the coming months, and we will continue to monitor developments closely.
Download the Alert here.
