Kenya’s Virtual Asset Service Providers Regulations, 2026: regulatory framework now operational
At last, Kenya has gazetted the Virtual Asset Service Providers Regulations, 2026 (the Regulations) to operationalise the licensing and supervisory framework established under the Virtual Asset Service Providers Act, 2025 (the Act). Together, the Act and Regulations create the first comprehensive licensing regime for virtual asset service providers (VASPs) in Kenya.
This means that VASPs operating in or targeting the Kenyan market should now move from policy monitoring to implementation. Key immediate priorities include assessing whether activities fall within the licensing perimeter, identifying the relevant regulator, mapping applicable prudential thresholds, and preparing governance, anti-money laundering, terrorism financing and proliferation financing (AML/CTF/CPF), cybersecurity, data protection and consumer-protection infrastructure and documentation.
Background
In our previous articles available here, here, and here, we highlighted that as from February 2024 when the Financial Action Task Force (FATF) placed Kenya on the grey list due to, among other reasons, the lack of a clear virtual assets legal framework, Kenya made a high level political commitment to enhance efforts against money laundering, terrorism financing and proliferation financing associated with virtual asset activities.
As part of the commitment to FATF, Kenya developed the National Policy on Virtual Assets and Virtual Asset Service Providers (VASP Policy) to articulate the virtual assets policy interventions that the Government of Kenya would take. One of the key policy interventions under the VASP Policy was the development of a legal framework on virtual assets, achieved through the Act, which commenced on 4 November 2025.
What do the Regulations achieve?
Although the Act established the legal framework, the regime could not become fully operational until the detailed licensing, prudential and compliance requirements were prescribed through the Regulations. The Regulations actualise the provisions of the Act and reflect the increasingly accepted regulatory principle that virtual asset activities should be regulated according to the risks they pose: the same activity and the same risk should attract the same regulatory treatment.
The Regulations contain the detailed requirements and procedures for the licensing of ten categories of virtual asset activities. The regulated activities are the provision of virtual asset wallet, exchange operation, payment processing, brokerage, investment advisory, asset management, initial coin offering issuance, tokenisation of real-world assets, token issuance platforms, and stablecoin issuance.
Licensing and supervision of VASPs is overseen primarily by the Central Bank of Kenya (CBK) for payment related activities and Capital Markets Authority (CMA) for investment related activities. Businesses operating across both payment related and investment related activities may require multiple licences and may therefore interact with both principal regulators. We also note that the Regulations permit a regulator, at its discretion, to issue to an applicant a single licence covering more than one virtual asset activity.
Licensing is subject to stringent governance and prudential requirements as well as fit and proper assessment of directors, shareholders, and senior officers. The prudential requirements are tiered by licence category under the Fifth Schedule to the Regulations. The highest prudential threshold applies to stablecoin issuers who must maintain paid-up capital of Kenya Shillings three hundred million (approximately USD 2,318,115 at current exchange rate), while virtual asset investment advisers are not subject to a minimum capital requirement.
An applicant for a licence must either be a company incorporated in Kenya or a foreign company registered in Kenya. Applicants must also maintain a physical presence in Kenya including a local office and banking arrangement. Additionally, an applicant must demonstrate to the relevant regulator that the applicant has adequate cybersecurity, AML/CTF/CPF, data protection and consumer-protection measures appropriate to the scale and risk profile of its proposed activities.
The Regulations stipulate ongoing obligations that licenced VASPs must comply with. These ongoing obligations focus on sound risk management, corporate governance, cybersecurity, consumer protection, data protection, among others. The Regulations prioritise consumer protection by requiring VASPs to use fair, clear, transparent, and non-deceptive marketing and promotional materials. Additional consumer protection measures that a VASP must implement include processes for handling customer complaints, securing customers’ virtual assets, maintaining sufficient reserves, and segregating virtual assets to protect them from creditor claims. The segregation requirements are designed to ensure that customer assets remain protected in the event of a VASP insolvency and are not available to satisfy claims by the VASP’s creditors.
In addition, the Regulations impose strong anti-money laundering and market integrity obligations. VASPs are subject to customer due diligence, transaction monitoring, sanctions compliance and suspicious transaction reporting obligations aligned to international standards developed by FATF. The Regulations prohibit high risk activities such as mixer and tumbler services that are designed to obscure the origin of virtual assets.
Stablecoin issuers are subject to enhanced prudential requirements. Stablecoin issuers must comply with requirements regarding the management of reserves, redemption-at-par, periodic disclosure obligations and independent reserve audits.
Last but not least, the Regulations prescribe the sanctions applicable to compliance breaches. They confer extensive powers on regulators and other competent authorities to investigate virtual asset activity and to freeze or seize virtual assets in appropriate circumstances. They also impose administrative fines of up to Kenya Shillings five million for companies and three million for individuals for regulatory breaches, and criminal penalties of up to Kenya Shillings eight million for companies and five million or five years’ imprisonment for individuals for market conduct offences such as insider dealing, market manipulation and front-running. Regulators have the power to impose additional administrative enforcement actions. A regulator can suspend or revoke the licence, approval or authorisation issued to any person under the Regulations.
What is happening now?
The licensing regime is now legally operational. We anticipate further implementation guidance and technical standards from regulators during the initial phase of implementation. CBK has been preparing for licensing since at least April 2026, when it advertised roles covering virtual asset licensing, product approval and compliance. Discussions have been ongoing in the virtual assets’ ecosystem and potential licensees who are looking to secure a first mover advantage are putting together application packs responsive to the regulatory requirements. Based on our experience as regulatory lawyers, we anticipate a substantial number of licence applications to be lodged by applicants in the next few months.
What this means for you
Existing operators should immediately assess whether any of their activities fall within the licensing perimeter and, where necessary, begin preparing licence applications ahead of the transition deadline of 4 November 2026. Prospective entrants should conduct regulatory mapping exercises to determine the licences required, applicable capital thresholds and governance requirements. Foreign providers servicing the Kenyan market should also review whether their current operating model could trigger licensing obligations in Kenya.
Looking ahead
The VASP Policy set out four objectives. First, a legal framework for virtual assets and VASPs, now delivered through the Act and the Regulations; second, a fair and efficient market; third, sound risk management; and fourth, financial literacy and innovation. We anticipate that the Government will progressively implement the remaining objectives through the coordination mechanisms established under the Act and the Regulations. We also expect CBK and CMA to issue implementation guidance, technical standards and supervisory expectations which will provide additional clarity on operational compliance requirements.
This is the first in a series of alerts in which we will unpack specific aspects of the Act and Regulations in greater depth. Watch this space for further instalments.
Should you have any questions on the Act, Regulations or wish to discuss how they may affect your business, please do not hesitate to contact Peter Mwaura at [email protected], Michael Okeyo at [email protected] or your usual Spencer West contact.
