Kenya’s Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) is now law. President William Ruto assented on October 15, 2025, and the Act commenced on November 4, 2025. It adopts a dual-regulator model—Central Bank of Kenya (CBK) for issuance/stablecoins; Capital Markets Authority (CMA) for exchanges/custody—anchored by robust AntiMoney Laundering/CounterFinancing of Terrorism (AML/CFT) obligations. Subsidiary regulations will flesh out licensing and conduct rules.

Why the VASP Act Matters for Digital Asset Businesses

Kenya moves from a grey zone to a rules-based market for digital assets. With the Act in force, expect clearer paths to bank accounts, investor confidence, and safer retail participation—while regulators clamp down on illicit finance risks.

How Kenya’s VASP Act Splits Regulation Between CBK and CMA

• Central Bank of Kenya (CBK): oversight of issuance and stablecoins (reserve quality, redemption, payment system safety).
• Capital Markets Authority (CMA): licensing/supervision of exchanges, brokers, and custodians, plus market conduct, disclosure, and client asset protection.
This split aligns oversight with function and mirrors global best practice for systemic stablecoins vs. market venues.
AntiMoney Laundering/CounterFinancing of Terrorism (AML/CFT) is the spine of the framework

Virtual Asset Service Providers (VASPs) become reporting institutions with duties around Know Your Customer/Customer Due Diligence (KYC/CDD), ongoing monitoring, Suspicious Transaction Report (STR) filings, recordkeeping/Travel Rule, governance and cybersecurity, and audits—critical to interoperability with banks and cross-border partners.

What Changes for Key Stakeholders

For Virtual Asset Service Providers (VASPs) & Web3 startups

• Bankability + legitimacy under a licensing regime.
• Higher bar: capital/solvency, fit and proper management, custody controls, incident reporting.
• Consolidation risk: compliance costs may push partnerships/mergers.
For consumers & investors

• Safer platforms: asset segregation, clearer fees/risks, cyber standards, and dispute channels.
• Lower counterparty risk on licensed venues vs. informal peer-to-peer (P2P).
For banks & incumbents

• Shift from blanket derisking to risk-based onboarding of licensed Virtual Asset Service Providers (VASPs).
• New lines: custody partnerships, stablecoin reserve services, analytics for compliance.
For the wider economy

• Investment magnet: legal certainty attracts quality players.
• Tax clarity & compliance improve as activity formalises (watch Kenya Revenue Authority (KRA) guidance).

What’s in Force—and What’s Next

• Status: Virtual Asset Service Provider (VASP) Act No. 20 of 2025; assent Oct 15, 2025; commencement Nov 4, 2025 (per Kenya Gazette).
• Next mileposts: Central Bank of Kenya (CBK)/Capital Markets Authority (CMA) to gazette implementing regulations (licence categories, prudential rules, disclosure/marketing standards, Travel Rule mechanics, transitional arrangements and timelines). Monitor regulator sites and Gazette notices.

90-Day Action Checklist (Practical Steps)

For Virtual Asset Service Providers (VASPs) / exchanges/custodians

1. Licensing readiness: gap analysis of capital, governance, Information Technology (IT)/cyber, ops resilience, client asset segregation.
2. Anti-Money Laundering (AML) uplift: risk assessment, Customer Due Diligence (CDD) tiers, Travel Rule vendor, Financial Reporting Centre (FRC) reporting workflow.
3. Incident & custody playbooks: hot/cold storage policy, key management, breach notification.
4. Disclosure pack: risk summaries, fee tables, Terms and Conditions (T&Cs), privacy + Data Protection Act, 2019 (DPA 2019) alignment.
5. Banking engagement: prepare compliance artefacts for onboarding.
For banks/payments players

1. Update policies to onboard licensed Virtual Asset Service Providers (VASPs) on a risk basis.
2. Explore custody/fiat onoff ramps/stablecoin services.
3. Integrate blockchain analytics for monitoring.
For corporates dabbling in Web3

1. Contract hygiene: clarify asset ownership, keys, Service Level Agreements (SLAs), incident duties with any Virtual Asset Service Provider (VASP) vendor.
2. Tax & accounting: define recognition, basis/realisation events; watch Kenya Revenue Authority (KRA) circulars.
3. Data protection: lawful basis, minimisation, cross-border transfer controls for Know Your Customer (KYC) data.

FAQs

Is the Virtual Asset Service Provider (VASP) Bill already law?
Yes. It’s now Act No. 20 of 2025, assented to on Oct 15, 2025, and commenced on Nov 4, 2025.

Who licenses what?
Central Bank of Kenya (CBK) handles issuance/stablecoins; Capital Markets Authority (CMA) handles exchanges, trading platforms, and custody.

Are there transitional windows?
Expect licensing windows and transitional provisions to be set out in gazetted regulations by the Central Bank of Kenya (CBK)/Capital Markets Authority (CMA). Keep an eye on official notices.

What happens to peer-to-peer (P2P) trading?
The Act targets intermediaries (VASPs). Peer-to-peer (P2P) will persist, but regulated venues should become safer defaults, with enforcement focused on illicit finance risks.

Bottom Line

Kenya’s Virtual Asset Service Provider (VASP) regime is now live. If implementation (capacity, coordination, clarity) matches ambition, Kenya can derisk participation, attract quality capital, and lead regionally while protecting users. For market players, the mandate is clear: get compliance-ready and build for a regulated future.

Legal disclaimer: This article is for general information only and does not constitute legal or tax advice. Engage professional counsel for specific guidance.

Stay informed with the latest legal developments at Global Law Experts News.