Kenya’s VASP Regulations Are Here: What Virtual Asset Businesses Should Do Next

Kenya has moved from proposing virtual-asset regulation to implementing it. The Virtual Asset Service Providers Regulations, 2026 were published as Legal Notice No. 134 of 2026 on 22 July 2026. They now provide the detailed licensing, governance, prudential and conduct rules needed to operationalise the Virtual Asset Service Providers Act, 2025.

For exchanges, custodial wallet providers, stablecoin issuers, brokers, payment processors, tokenisation businesses and other operators serving Kenya, the central question is no longer whether regulation is coming. It is whether the business can identify the correct licence, meet the financial and governance tests, build a credible application file and operate within the new supervisory framework.

The Regulations convert regulatory anticipation into a licensing and operational-readiness exercise. Existing operators have a transition deadline; new entrants require a compliant route before commencing regulated activity.

1. What changed when the Regulations were gazetted?

The Act created the statutory perimeter, designated the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) as the principal regulators, and prohibited unlicensed virtual-asset services. The Regulations supply the operating detail: application forms and supporting evidence, licence fees, paid-up and liquid capital, governance, custody, complaints, cybersecurity, advertisements, stablecoin reserves, token offerings, reporting, inspections and enforcement.

The final framework also recalibrates several proposals contained in the March 2026 draft. Most paid-up capital thresholds were reduced, the proposed 0.05% levy on every exchange and token-platform transaction was removed, and the proposed 33.3% ownership cap did not appear in the final rules. Acquisitions and significant ownership changes remain subject to notification or approval requirements.

These changes make some licence categories more accessible, but they do not turn licensing into a form-filling exercise. The regulators will examine the applicant’s ownership, source of funds, governance, technology, financial resilience, AML/CFT/CPF programme, customer protection and ability to operate the proposed service safely.

2. Who is caught by the framework?

The Regulations apply to persons offering virtual-asset services in or from Kenya. Importantly, a person may be treated as operating in or from Kenya where the person derives economic benefit or income from Kenya, even without a physical presence in the country.

The analysis therefore extends beyond Kenyan-incorporated crypto companies. A foreign platform that actively onboards Kenyan customers, earns fees from Kenyan activity, markets services into Kenya, settles Kenyan transactions or otherwise derives income from the market should undertake a Kenyan regulatory-perimeter assessment.

Businesses potentially within scope include:

• custodial wallet providers and businesses controlling customers’ virtual-asset keys;
• virtual-asset exchanges and conversion platforms;
• virtual-asset payment processors;
• brokers arranging or executing virtual-asset transactions;
• investment advisers and managers dealing with virtual assets;
• fiat-referenced stablecoin issuers;
• initial coin offering providers;
• businesses tokenising real-world assets; and
• token-issuance or virtual-asset-offering platforms.

An individual merely buying, holding or transferring virtual assets for personal purposes is not automatically a VASP. The concern is the provision of covered services as a business. Labels such as “technology provider”, “marketplace”, “community”, “offshore platform” or “non-custodial product” will not determine the result where the actual product performs a regulated function.

3. Which regulator applies?

Responsibility is divided by activity. A group offering several services may therefore require more than one licence and may interact with both regulators.

A platform operating an exchange while also providing its own custodial wallet may fall within both sides of the framework. The correct approach is to map each service, transaction flow and custody function separately before deciding what application—or combination of applications—is required.

4. Final minimum paid-up capital thresholds

The Fifth Schedule differentiates capital by activity. The following are the final minimum paid-up capital amounts. Separate liquid-capital, insurance and continuing financial requirements also apply and should be modelled before the application is submitted.

Capital must be genuine qualifying capital. Shareholder loans, borrowed funds, unpaid commitments and internally generated intangible assets are not substitutes for paid-up capital. A multi-activity business should also test whether capital requirements accumulate across its licence categories rather than assuming the highest single figure will cover the group.

Stablecoin issuers face the highest prudential threshold and must also satisfy reserve, liquidity, segregation and redemption requirements. The final rules prescribe minimum liquid capital of KES 60 million or 100% of current liabilities for at least thirty days, whichever is higher, alongside full reserve-backing obligations.

5. What should be in a licensing-readiness file?

A credible application begins with the operating model, not the form. The file should enable the regulator to understand who owns and controls the applicant, what service it will provide, how customer assets and information will move, how the business is funded and how material risks will be controlled.

Core workstreams include:

1. Service and licence mapping: document every product, transaction flow, custody point, revenue stream, customer location and outsourced function.
2. Corporate structure: establish the appropriate Kenyan entity, identify direct and ultimate beneficial ownership, and document the source of shareholder funds.
3. Fit-and-proper evidence: prepare complete records for directors, senior officers, significant shareholders and beneficial owners.
4. Business plan and financial model: align forecasts, capital, liquidity, insurance, staffing and technology costs with the licensed activities.
5. Governance: design a board and committee structure, reporting lines, delegated authorities, conflicts controls and independent oversight proportionate to the business.
6. AML/CFT/CPF framework: establish risk-based CDD and EDD, beneficial-ownership verification, PEP and sanctions screening, transaction monitoring, suspicious-transaction escalation, record retention and staff training.
7. Technology and cybersecurity: document system architecture, access controls, key management, penetration testing, incident response, vendor oversight, business continuity and disaster recovery.
8. Customer and market conduct: prepare terms, risk disclosures, complaints procedures, advertising controls, custody disclosures and customer-asset protections.
9. Operational policies: include risk management, outsourcing, conflicts, market abuse, asset listing, custody, complaints, data protection and regulatory reporting.

6. Governance cannot be left until the application is ready

The final rules expect an institutional governance model. Applicants should plan for at least three directors, with at least one-third independent, and separation between the board chairperson and chief executive. The proposed board must collectively possess the financial, legal, compliance, risk and technology competence needed for the licensed activity.

That requirement can materially affect founder-led businesses. A structure in which all commercial, technical, custody and compliance decisions sit with one founder may need to be reorganised. The regulator will be interested in who can challenge management, who owns compliance decisions, how incidents are escalated and whether the board receives reliable risk information.

7. The operational obligations are as important as obtaining the licence

Licensing is the beginning of supervision. A VASP will need continuing evidence that its controls operate in practice.

• Customer assets: client virtual assets must be protected and segregated from the provider’s own assets and from third-party creditor claims.
• AML/CFT/CPF: onboarding, monitoring, sanctions, suspicious-activity reporting and record keeping must operate across the full customer and transaction lifecycle.
• Records: relevant records must generally be retained for seven years and remain capable of production to the regulator.
• Material changes: changes affecting information supplied during licensing may require very prompt notification; internal change-management procedures should include a regulatory trigger assessment.
• Cybersecurity and continuity: technology risk, wallet and key controls, incident response, backups, recovery testing and outsourced infrastructure require documented ownership and testing.
• Advertising: promotions must be fair, clear and not misleading, with suitable risk warnings. The rules extend to online and influencer promotions and prohibit cold calling.
• Stablecoins: issuers face reserve-management, redemption, disclosure and white-paper approval requirements. Redemption is generally expected at par within two working days.

8. What commercial benefit does the framework provide?

The compliance burden is substantial, but a functioning licensing framework also creates commercial advantages for businesses capable of meeting it.

• Regulatory certainty: founders and investors can structure against defined licence categories rather than a prolonged grey area.
• Institutional credibility: a licensed and supervised entity is better placed to engage banks, payment partners, insurers, investors and enterprise customers.
• Consumer confidence: segregation, reserve, complaints and disclosure rules create a clearer basis for customer trust.
• Market discipline: fit-and-proper, governance and market-conduct requirements should make it harder for undercapitalised or opaque operators to compete through regulatory arbitrage.
• A platform for regional growth: a credible Kenyan regulatory position can support expansion discussions elsewhere in Africa, although each market still requires its own analysis.

These benefits are not automatic. The licence should be integrated into product design, partner contracts, governance and operating controls rather than treated as a certificate obtained by the legal department.

9. Existing operators: the 4 November 2026 deadline

Section 47 of the Act gave persons already providing virtual-asset services one year from the Act’s commencement to comply. The Act commenced on 4 November 2025, making 4 November 2026 the key transition deadline.

As at 27 July 2026, existing operators have roughly one hundred days remaining. That is a short period for restructuring ownership, incorporating locally, raising qualifying capital, recruiting independent directors, producing audited or verified financial information, completing security testing, negotiating insurance and preparing the required policies and evidence.

An existing operator should not wait for the final weeks or assume that an incomplete filing will resolve its position. It should establish the applicable licence immediately, open a structured engagement with the relevant regulator and maintain a board-approved transition plan. A new entrant should not rely on the existing-operator transition and should obtain advice before launching regulated services.

10. A practical 30-day readiness plan

1. Week 1 — perimeter and gap assessment: map services, customers, custody, revenue and group entities; determine the regulator and licence categories; identify activities that may need to pause or be restructured.
2. Week 2 — structure and financial capacity: confirm the Kenyan entity, ownership and governance model; test paid-up and liquid capital; identify directors, key officers, banking and insurance requirements.
3. Week 3 — controls and evidence: assess AML/CFT/CPF, cybersecurity, custody, complaints, data protection, outsourcing, business continuity and market-conduct controls against the final Regulations.
4. Week 4 — application roadmap: assign document owners, close critical gaps, prepare the regulator-engagement pack and establish an evidence-controlled application timetable to the transition deadline.

Practical takeaway

Kenya’s final VASP Regulations create both a market-entry opportunity and a compressed compliance challenge. The businesses best placed to benefit will be those that classify their services accurately, build the right regulatory structure, demonstrate qualifying capital and turn policy documents into functioning controls.

S.N. Nyaga & Company Advocates advises virtual-asset businesses, fintechs, investors and technology providers on Kenyan regulatory-perimeter assessments, licence strategy, market entry, governance, AML/CFT/CPF frameworks, customer documentation and application readiness.

Legal notice: This publication provides general information as at 27 July 2026. It is not legal advice and should not be relied upon as a substitute for advice on a particular product, service, structure or application. The regulators may issue additional forms, guidance or implementation directions.