Kenya's Virtual Asset Service Provider Licensing Regime: What the Virtual Asset Service Providers Act, 2025 Means for Crypto Businesses

For cross-border crypto businesses, exchanges, wallet providers, token issuers and in-house compliance teams: this guide explains the scope of the new regime, the transitional window under the Virtual Asset Service Providers Act, 2025, capital and liquidity expectations, the regulator split between the CMA and CBK, application requirements, extra-territorial reach and an actionable pre-deadline checklist.

Kenya’s virtual asset service provider licensing regime has entered a decisive phase following the enactment of the Virtual Asset Service Providers Act, 2025. Any business that offers virtual asset services in or from Kenya must be licensed, or have a compliant application in train, before the statutory transitional window closes. The framework is being built out in stages: the Act sets the primary architecture, and subsidiary regulations are expected to supply the operational detail on capital, application documents and supervision. This article maps the licensable activities, the anticipated capital requirements, the CMA/CBK split and the likely reach of the rules over offshore operators, and sets out precisely what an existing operator should already have in motion.

Because the commencement date and certain subsidiary instruments may be phased in, operators must verify the current status of the Act and any regulations against the official gazette and the relevant regulators.

Executive summary and key takeaways

• Transitional window. The Act provides a transitional period for existing operators to become licensed. Operators must confirm the exact commencement date and the length of the transitional window against the gazetted Act, as operating without a licence after the window closes is an offence.
• Who must apply. Any person or entity providing a licensable virtual asset service in or from Kenya, potentially including offshore platforms that solicit or serve Kenyan users.
• Capital. Minimum capital requirements are expected to vary by activity, with lower thresholds for lower-risk services and higher thresholds for higher-risk activities such as issuing value-referenced instruments. Exact figures should be confirmed against the gazetted regulations.
• Two regulators. Supervision is split between the Capital Markets Authority (CMA) and the Central Bank of Kenya (CBK), depending on the activity.
• Immediate steps. Confirm your activity is in scope, identify your supervisor, verify capital adequacy, assemble the required documents and appoint a fit-and-proper compliance function well before the deadline.

The core message for anyone assessing Kenya’s virtual asset service provider licensing obligations is simple: the runway is finite, and the documentation, governance and capital requirements cannot be assembled overnight.

Legal framework and timeline: the Act and subsidiary regulations

The regime rests on the Act and its subsidiary regulations. Understanding how they interlock is the starting point for any compliance assessment.

Virtual Asset Service Providers Act, 2025, the key features

The Virtual Asset Service Providers Act is the primary statute governing virtual asset services in Kenya. It establishes the licensing obligation, defines virtual asset services, allocates supervisory authority between the CMA and the CBK, and creates offences for unlicensed activity. Three matters are most relevant to the current deadline:

• Commencement. The Act (or its relevant provisions) commences on a date determined under the Act. This event starts the transitional clock, and operators should confirm the operative date against the official gazette.
• Transitional window. The Act provides existing operators a defined period from commencement to become licensed. Verify the length of that window and the resulting cut-off date against the gazetted text.
• Offence for unlicensed activity. The Act creates criminal and civil exposure for carrying on a virtual asset business without the required licence.

Subsidiary regulations

Subsidiary regulations under the Act are expected to supply the operational detail. Where the Act sets the framework, the regulations are anticipated to contain the test for who is “operating in or from Kenya”, the detailed application requirements and fit-and-proper standards, any requirement to commence business within a fixed period of the grant of a licence, and a schedule listing the licensable services with their capital thresholds. Operators should confirm which regulations have been gazetted and are in force before relying on any specific provision.

For VASP licensing planning purposes, treat the regulations as the operative rulebook and the Act as the source of the deadline and the penalty. Confirm all dates against the official gazette.

Who is in scope? Defining “operating in or from Kenya”

One of the most consequential features of Kenya’s virtual asset service provider licensing framework is its reach. The regime is expected not to confine itself to companies incorporated in Kenya. The framework is designed to capture offshore platforms with Kenyan touchpoints.

The “operating in or from Kenya” test in plain language

The deeming approach is designed to prevent operators from avoiding supervision merely by locating servers or corporate structures abroad. In substance, an offshore provider is likely to fall within the regime where it actively solicits or targets persons in Kenya, or where it derives an economic benefit from providing virtual asset services to Kenyan users. This is the pivot on which the extra-territorial reach turns. Operators should confirm the precise wording of the applicable provision once the regulations are in force.

Tests for active solicitation and deriving economic benefit

Two limbs of the analysis deserve careful attention:

• Active solicitation or targeting. Marketing directed at Kenyan residents, local-language or local-currency pages, Kenya-specific promotions, or advertising placed to reach the Kenyan market all point toward being in scope.
• Deriving economic benefit. Earning fees, spreads, commissions or other revenue from Kenyan customers indicates the platform is benefiting economically from the local market, which weighs strongly toward the licensing obligation.

Practical indicators for websites and payment routing

Because the analysis is fact-sensitive, operators should audit concrete indicators rather than rely on formal structure alone. Relevant factors include whether the site accepts sign-ups from Kenyan IP addresses, whether onboarding accepts Kenyan identity documents, whether the platform routes payments through Kenyan fiat rails or mobile money, and whether any geofencing is genuinely enforced. A platform that claims not to serve Kenya but continues to onboard Kenyan users and collect fees from them is exposed. The prudent course for offshore crypto platforms with any Kenyan footprint is to assume they may be in scope and to seek formal clarification where the position is uncertain.

Licensable virtual asset services

The Act and its regulations set out the licensable services and are expected to attach a minimum capital figure to each category. This is the heart of Kenya’s virtual asset service provider licensing scope: if your business model matches a licensable activity and you operate in or from Kenya, you must be licensed. The table below maps common categories to indicative supervisory allocation. Operators must verify the exact figures and categories against the gazetted schedule, as that text is the authoritative reference.

Key examples: broker, payment processor and stablecoin issuer

Three examples illustrate the likely spread. A virtual asset broker or payment processor is expected to sit at the lower end of the capital range. A stablecoin or value-referenced token issuer is expected to sit at the top, reflecting the systemic and consumer-protection concerns attached to issuing value-referenced instruments. Operators should classify their activity precisely, because a single business may straddle more than one category and therefore attract more than one capital obligation. The specific monetary thresholds must be confirmed against the gazetted regulations.

Capital and liquidity requirements: minimums by service

Meeting the capital requirements for a VASP in Kenya is not a formality, it is a gating condition for licensing and a continuing obligation. The regulations are expected to set minimum capital by category, with liquid-capital requirements layered on top so that a licensee holds sufficient readily realisable assets to meet obligations as they fall due. Because the exact figures are set by the regulator, operators should treat any numbers circulating informally as unconfirmed until verified against the gazetted schedule.

Compliance approaches to capital

Existing operators should model their position now. Practical approaches include capitalising the Kenyan operating entity to the required floor, arranging shareholder injections documented with a clear source-of-funds trail, and structuring liquid assets so that any liquid-capital floor is satisfied on an ongoing basis rather than only at the point of application. Where a group operates several licensable activities through one vehicle, the capital analysis must aggregate the applicable floors.

Transitional capital issues for existing operators

The most common trap for operators approaching Kenya’s virtual asset service provider licensing is discovering, late in the transitional window, that their Kenyan entity is under-capitalised or that funds cannot be evidenced to the standard the regulator expects. Capital raising, board approvals, audited accounts and source-of-funds documentation all take time. Because the transitional window is fixed, capital adequacy should be resolved months ahead, not in the final weeks. Treat the prescribed minimum as the floor, not the target, since regulators may expect additional buffers relative to the scale and risk of the business.

Split supervision: CMA vs CBK, regulatory mapping

A defining feature of the Kenyan regime is that supervision is shared. The CMA/CBK allocation determines which authority you apply to, which conditions attach to your licence, and which supervisor conducts ongoing oversight.

Activities under the CMA remit

The Capital Markets Authority (CMA) generally supervises activities with a markets, investment or trading character, exchanges, brokerage, custody of virtual assets, portfolio management, advisory services and token offering platforms. These map onto the CMA’s existing competence over securities markets and investor protection.

Activities under the CBK remit

The Central Bank of Kenya (CBK) generally supervises activities with a payments, money-transmission or monetary character, payment processing in virtual assets, transfer services and, most significantly, stablecoin or value-referenced token issuance. Value-referenced instruments touch on payment-system integrity and monetary policy, which places them naturally within CBK oversight.

Cooperative supervision

Where an activity has features of both, or where a business conducts multiple services, the two regulators are expected to coordinate. Operators uncertain about their supervisor should seek confirmation early rather than filing with the wrong authority and losing time.

Application requirements: fit and proper and documents

The regulations set out what an applicant must submit and the standards the regulator applies. This is where most of the practical work of Kenya’s virtual asset service provider licensing sits, and it is document-heavy.

Fit and proper assessment, what it looks for

The fit and proper assessment tests the integrity, competence and financial soundness of those who control and run the business. Regulators typically examine the track record of directors and senior officers, any history of regulatory sanction or criminal conduct, relevant experience, and the financial standing of the applicant and its controllers. Weak governance or unexplained gaps in the ownership chain are common reasons for delay.

Business plan, source of funds and AML/CFT

Applicants are expected to submit a credible business plan describing the services, target market, revenue model and risk controls. A source-of-funds statement is typically required to demonstrate that capital is legitimately derived. AML/CFT arrangements must be documented, consistent with the obligations under Kenya’s Proceeds of Crime and Anti-Money Laundering Act and overseen by the Financial Reporting Centre, and aligned with international standards articulated by the FATF, including customer due diligence, transaction monitoring, sanctions screening and suspicious-transaction reporting.

Disclosures of controllers and beneficial owners

Applicants are typically required to disclose directors, senior officers, significant shareholders and beneficial owners. Complete and accurate beneficial-ownership information is essential, opaque structures are a red flag under both the licensing and the AML/CFT regimes.

Timelines and fees

Applicants should budget realistically for processing time and prescribed fees, and build in a margin for regulator queries and requests for further information. Prescribed fees are set by the regulator and should be confirmed against current fee schedules. Given the fixed transitional deadline, filing early is the only reliable way to preserve continuity of operations through the transition.

Licensing conditions and offences

Securing a licence is not the end of the compliance obligation, it triggers further conditions, and failing to hold a licence carries serious consequences.

Requirement to commence business after grant

Regulations of this kind commonly require a licensee to commence business within a fixed period of the grant of the licence. A dormant licence is not the intended outcome; operators are generally expected to become active within any prescribed window or risk their authorisation. Confirm the applicable period against the gazetted regulations.

Criminal and civil exposure for unlicensed activity

The Act creates the offence of carrying on virtual asset business without a licence. This exposure includes potential criminal sanction and financial penalties, and the risk crystallises after the transitional window closes for any operator that has neither obtained a licence nor secured lawful transitional cover.

Likely enforcement steps

Industry observers expect the supervisory authorities to prioritise operators with the largest Kenyan footprints and the clearest solicitation of Kenyan users. The likely practical effect is that offshore platforms visibly serving Kenyan customers, and domestic operators trading openly, will face the earliest scrutiny. Early engagement with the regulator is generally viewed more favourably than reactive compliance after enforcement contact.

Practical implications for offshore providers, wallets and token platforms

For offshore operators, the combination of the extra-territorial reach and the unlicensed-activity offence makes Kenya’s virtual asset service provider licensing a live commercial question rather than a theoretical one.

Onboarding Kenyan users and KYC/AML routing

Platforms that onboard Kenyan users must decide whether to license in Kenya, to genuinely and effectively exclude Kenyan users, or to restructure their offering. Half-measures, nominal terms-of-service exclusions that are not enforced, are unlikely to protect against a deeming test.

Payment processors and fiat rails

Where a platform relies on Kenyan payment rails or mobile money to move value in or out, the economic-benefit limb of the analysis is difficult to escape. Payment-related activity also tends to fall within the CBK remit, so operators should map their payment flows carefully.

Assessing “deriving economic benefit”

The safest approach is to document, for each revenue stream, whether it can be attributed to Kenyan users. If it can, the platform should assume it is in scope and plan accordingly.

What an existing operator should already have in train

With the transitional deadline fixed, the following compliance checklist reflects what a well-prepared operator navigating Kenya’s virtual asset service provider licensing should already be advancing:

• Scope determination. A documented analysis of which licensable services the business provides and whether the “operating in or from Kenya” test applies.
• Regulator identification. Confirmation of whether the CMA, the CBK, or both will supervise the activity.
• Capital adequacy. Evidence that the applicable minimum capital and any liquid-capital floor are satisfied, verified against the gazetted schedule.
• Governance and personnel. Fit-and-proper directors and senior officers, and an appointed, trained compliance officer.
• AML/CFT and sanctions policies. Written policies covering customer due diligence, monitoring, sanctions screening and suspicious-transaction reporting, aligned with FRC and FATF expectations.
• Audited accounts and source-of-funds. Recent audited financial statements and a clear, documented source-of-funds trail for capital.
• Beneficial-ownership disclosures. Complete records of significant shareholders and ultimate beneficial owners.
• Technology and security. Custody, key-management and cybersecurity controls, ideally supported by an independent security audit.
• Business plan. A credible plan meeting the applicable regulatory standard.

Next steps, risk matrix and recommended timeline

Operators that have not yet applied should compress the work into a structured plan. A practical sequence runs roughly as follows:

1. Weeks 1–2: Complete the scope and regulator analysis and identify the applicable capital floor.
2. Weeks 3–5: Resolve capital adequacy, prepare source-of-funds documentation and finalise beneficial-ownership records.
3. Weeks 6–8: Draft the business plan, AML/CFT policies and governance documents; appoint the compliance officer.
4. Weeks 9–10: Obtain audited accounts, complete the security audit and assemble the application pack.
5. Weeks 11–12: File with the CMA or CBK, allowing time for regulator queries before the transitional deadline.

On a risk basis, operators actively soliciting Kenyan users and running high-capital activities such as stablecoin issuance are highest priority; operators with incidental Kenyan exposure and lower-capital activities carry medium risk; operators that can cleanly and genuinely exclude Kenya may be lower risk, provided the exclusion is real and enforced.

For businesses selecting local advisers, GLE’s Banking lawyers in Kenya, guide is a useful starting point for identifying qualified counsel.

Conclusion

Kenya’s virtual asset service provider licensing regime has moved from principle to a phased implementation. With the Virtual Asset Service Providers Act, 2025 setting the framework and subsidiary regulations expected to supply the capital floors, the reach test and the application requirements, operators can no longer treat compliance as a distant project. The practical priorities are clear: confirm scope, identify whether the CMA or CBK supervises the activity, meet the applicable capital requirement with any liquid-capital buffer, and file a complete application with time to spare.

Because the deadline is statutory and fixed, the businesses best placed to preserve continuity are those that treat Kenya’s virtual asset service provider licensing as an immediate operational imperative, verify the current gazetted text of the Act and regulations, and engage qualified Kenyan counsel now.

This article is for general information only and does not constitute legal advice. The Act and its regulations are being implemented in stages; dates, capital figures and procedures should be verified against the official gazette and the relevant regulators. Operators should obtain formal advice from qualified Kenyan counsel and, where scope or supervisory allocation is uncertain, seek clarification directly from the CMA or CBK before the transitional deadline.

Sources

1. Virtual Asset Service Providers Act, 2025 (Kenya), Kenya Law
2. Capital Markets Authority (CMA) Kenya
3. Central Bank of Kenya (CBK)
4. Financial Reporting Centre (FRC) Kenya
5. Financial Action Task Force (FATF), Guidance on Virtual Assets
6. Kenya Law Reports