Reviewed and refreshed: 14 November 2026. This edition replaces the earlier transition-focused guide with an operating-evidence approach for founders, boards and compliance teams.
A licensing application can look excellent on paper and still describe a business that does not exist in practice. If the application, customer contract and asset-flow diagram identify different responsible entities, the problem is not presentation. It is the operating model.
An application is not a licence. A policy is not, by itself, evidence that a control works.
The current framework, without the shortcuts
The final Virtual Asset Service Providers Regulations, 2026 were gazetted on 22 July 2026 as Legal Notice No. 134. Regulation 4 covers services in or from Kenya, including specified circumstances without a physical presence. An offshore structure does not settle the Kenyan analysis.
Regulation 6 requires an application supported by ownership and management information, fit-and-proper material, source-of-funds evidence, a business plan, policies, contracts, financial and resource evidence and an independent systems audit. Requirements vary with the activity. The decision period depends on receipt of the required information and completion of due diligence, not merely sending a form.
Preparing, applying and being licensed are distinct statuses. Businesses should verify their actual authorisation and any applicable conditions rather than infer permission to operate from preparation, payment or an acknowledgement.
The joint CBK/CMA notice dated 13 November 2026 directs current and intending providers to apply to the relevant regulator and consult its checklists. It does not announce an extension or automatic permission to operate while an application is pending.
1. Start with the service, not the label
Before commissioning another policy, put the product, finance, operations and compliance leads around the same transaction diagram. Ask them to describe one ordinary customer journey and one failed transaction.
- Which entity contracts with the customer?
- Who receives money or assets, and in whose name?
- Who controls keys, approvals and transaction execution?
- Who processes redemption or withdrawal requests?
- Which functions are outsourced, and who remains accountable internally?
A label such as “crypto platform” is too broad to answer those questions. Map each service and entity separately, then assess the applicable regulatory route. A disagreement between teams is useful evidence of a gap to resolve, not something to conceal with consistent wording.
2. Turn each assertion into something testable
Our practical recommendation is to pair every important application assertion with an owner and a supporting record. The record should demonstrate the actual arrangement, not simply repeat the assertion.
| Business assertion | Practical evidence question |
|---|---|
| Customer assets are protected. | Do account arrangements, customer terms, access permissions and reconciliations tell the same story? |
| A critical supplier is controlled. | What does the contract permit, who monitors performance, and how would the business exit or recover? |
| Incidents can be managed. | Who can make decisions, who can be contacted, and what did the latest test reveal? |
| Responsibilities are clear. | Do delegated authorities, system permissions and actual working practices match? |
These are preparation questions, not a substitute for the applicable legal checklist. The appropriate evidence depends on the service, structure and risk. A signed policy is useful, but it does not show that an account was reconciled or a recovery procedure tested.
3. Give the board a decision pack, not a document pile
A useful readiness pack should make decisions visible. We suggest five short sections:
- Operating model: services, entities, customers, assets and critical dependencies.
- Regulatory route: the proposed activity classification, supporting analysis and unresolved questions.
- Evidence map: the supporting record for each important assertion, with its owner and review date.
- Gaps and consequences: what is missing or inconsistent, why it matters and which decision it prevents.
- Action plan: named owners, realistic dates and the decisions required before the next milestone.
Use separate statuses for a planned control, an implemented control and a tested control. Treat an unanswered regulatory question as unresolved rather than allowing it to disappear inside a completed-document percentage.
4. Keep investor and customer language aligned with reality
Commercial language should not outrun the evidence. “Preparing an application”, “application submitted” and “licensed” communicate different things. Preserve that distinction in pitch materials, partner discussions, website copy and customer communications.
Equally, a foreign authorisation should be described accurately rather than presented as a substitute for checking the Kenyan position. Verify the entity, activity, jurisdiction and conditions before making a public statement about regulatory status.
The smallest useful next step
Choose one product. Draw its transaction flow. Ask the responsible team to identify the contracting entity, the location and control of customer assets, the critical suppliers and the evidence supporting each arrangement. Record the disagreements and assign someone to resolve them.
That exercise will not complete a licensing application. It can, however, reveal whether the proposed application and the real business describe the same operation.
The objective is not merely to assemble documents. It is to build a business capable of operating consistently with them.
For a scoped review of the operating model and readiness gaps, see our VASP licensing and application-support services. Scope and fees are agreed before work begins.
General information: This article is not advice on a particular business, an exhaustive compliance checklist or confirmation that an activity is authorised. The applicable position requires review of the actual service, documents and current regulatory directions.