Kenya’s Virtual Asset Service Provider (VASP) Act 2025: What the New Digital-Assets Regime Means for Businesses, Banks, and Consumers

Kenya’s Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) is now law. President William Ruto assented on October 15, 2025, and the Act commenced on November 4, 2025. It adopts a dualregulator model—Central Bank of Kenya (CBK) for issuance/stablecoins; Capital Markets Authority (CMA) for exchanges/custody—anchored by robust AntiMoney Laundering/CounterFinancing of Terrorism (AML/CFT) obligations. Subsidiary regulations will flesh out licensing and conduct rules.

Why this matters (now)

Kenya moves from a grey zone to a rulesbased market for digital assets. With the Act in force, expect clearer paths to bank accounts, investor confidence, and safer retail participation—while regulators clamp down on illicitfinance risks.

The big design choice: Two regulators, distinct roles

• Central Bank of Kenya (CBK): oversight of issuance and stablecoins (reserve quality, redemption, paymentsystem safety).
• Capital Markets Authority (CMA): licensing/supervision of exchanges, brokers, and custodians, plus market conduct, disclosure, and clientasset protection.
This split aligns oversight with function and mirrors global best practice for systemic stablecoins vs. market venues.
 

AntiMoney Laundering/CounterFinancing of Terrorism (AML/CFT) is the spine of the framework

Virtual Asset Service Providers (VASPs) become reporting institutions with duties around Know Your Customer/Customer Due Diligence (KYC/CDD), ongoing monitoring, Suspicious Transaction Report (STR) filings, recordkeeping/Travel Rule, governance and cybersecurity, and audits—critical to interoperability with banks and crossborder partners.

What changes for key stakeholders

For Virtual Asset Service Providers (VASPs) & Web3 startups

• Bankability + legitimacy under a licensing regime.
• Higher bar: capital/solvency, fitandproper management, custody controls, incident reporting.
• Consolidation risk: compliance costs may push partnerships/mergers.
For consumers & investors

• Safer platforms: asset segregation, clearer fees/risks, cyber standards, and dispute channels.
• Lower counterparty risk on licensed venues vs. informal peertopeer (P2P).
For banks & incumbents

• Shift from blanket derisking to riskbased onboarding of licensed Virtual Asset Service Providers (VASPs).
• New lines: custody partnerships, stablecoin reserve services, analytics for compliance.
For the wider economy

• Investment magnet: legal certainty attracts quality players.
• Tax clarity & compliance improve as activity formalizes (watch Kenya Revenue Authority (KRA) guidance).
 

What’s in force—and what’s next

• Status: Virtual Asset Service Provider (VASP) Act No. 20 of 2025; assent Oct 15, 2025; commencement Nov 4, 2025 (per Kenya Gazette).
• Next mileposts: Central Bank of Kenya (CBK)/Capital Markets Authority (CMA) to gazette implementing regulations (licence categories, prudential rules, disclosure/marketing standards, Travel Rule mechanics, transitional arrangements and timelines). Monitor regulator sites and Gazette notices.
 

90day action checklist (practical steps)

For Virtual Asset Service Providers (VASPs) / exchanges / custodians

1. Licensing readiness: gapanalyse capital, governance, Information Technology (IT)/cyber, ops resilience, clientasset segregation.
2. AntiMoney Laundering (AML) uplift: risk assessment, Customer Due Diligence (CDD) tiers, Travel Rule vendor, Financial Reporting Centre (FRC) reporting workflow.
3. Incident & custody playbooks: hot/cold storage policy, key management, breach notification.
4. Disclosure pack: risk summaries, fee tables, Terms and Conditions (T&Cs), privacy + Data Protection Act, 2019 (DPA 2019) alignment.
5. Banking engagement: prepare compliance artefacts for onboarding.
For banks / payments players

1. Update policies to onboard licensed Virtual Asset Service Providers (VASPs) on a risk basis.
2. Explore custody/fiat onoff ramps/stablecoin services.
3. Integrate blockchain analytics for monitoring.
For corporates dabbling in Web3

1. Contract hygiene: clarify asset ownership, keys, Service Level Agreements (SLAs), incident duties with any Virtual Asset Service Provider (VASP) vendor.
2. Tax & accounting: define recognition, basis/realisation events; watch Kenya Revenue Authority (KRA) circulars.
3. Data protection: lawful basis, minimisation, crossborder transfer controls for Know Your Customer (KYC) data.
 

FAQs

Is the Virtual Asset Service Provider (VASP) Bill already law?
Yes. It’s now Act No. 20 of 2025, assented Oct 15, 2025, commenced Nov 4, 2025.

Who licenses what?
Central Bank of Kenya (CBK) handles issuance/stablecoins; Capital Markets Authority (CMA) handles exchanges, trading platforms, and custody.

Are there transitional windows?
Expect licensing windows and transitional provisions to be set out in gazetted regulations by Central Bank of Kenya (CBK)/Capital Markets Authority (CMA). Keep an eye on official notices.

What happens to peertopeer (P2P) trading?
The Act targets intermediaries (VASPs). peertopeer (P2P) will persist, but regulated venues should become safer defaults, with enforcement focused on illicitfinance risks.

Bottom line

Kenya’s Virtual Asset Service Provider (VASP) regime is now live. If implementation (capacity, coordination, clarity) matches ambition, Kenya can derisk participation, attract quality capital, and lead regionally while protecting users. For market players, the mandate is clear: get complianceready and build for a regulated future.

Legal disclaimer: This article is for general information only and does not constitute legal or tax advice. Engage professional counsel for specific guidance.