How to Obtain a VASP Licence in Kenya CBK & CMA Step‑by‑step Guide

VASP licensing in Kenya is now a statutory requirement for any business offering virtual asset exchange, custody, transfer, brokerage, or tokenisation services to or from Kenyan customers. Since the Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025, Kenya has moved from an era of regulatory warnings and ad‑hoc guidance to a fully codified licensing regime. The implementing Regulations, gazetted as Legal Notice No. 134 in July 2026, completed the framework and established enforceable deadlines, fee schedules, and capital thresholds that every virtual asset service provider in Kenya must now satisfy.

This guide covers every element a founder, exchange operator, fintech compliance lead, or in‑house counsel needs: the dual‑regulator structure (Central Bank of Kenya and Capital Markets Authority), licence categories and fees, AML/KYC duties under Kenyan law and FATF standards, a full documentation checklist, realistic timelines, and the commercially critical 12‑month commence rule and 36‑month licence‑transfer lock. Whether you are incorporating a new Kenyan entity or bringing an existing platform into compliance, the information below will help you plan, budget, and execute your application.

For a quick assessment of your readiness, check eligibility with GLE’s Kenya counsel before assembling your application pack.

Quick Legal Summary: The VASP Act & Implementing Regulations

Key Dates and What Changed

The Virtual Asset Service Providers Act received presidential assent and commenced on 4 November 2025. The Act defined “virtual assets” and “virtual asset service providers” for the first time in Kenyan statute, created licensing obligations, and designated two regulators according to the type of activity a VASP conducts.

The National Treasury published draft VASP Regulations in March 2026 for public consultation, with submissions closing 10 April 2026. Following industry feedback, the final Regulations were gazetted as Legal Notice No. 134 in July 2026, prescribing application forms, fee schedules, paid‑up capital thresholds, AML programme requirements, and the critical transfer‑restriction and commencement‑of‑operations rules.

Who Enforces What CBK vs CMA

The Act establishes an activity‑based split between the two regulators. The Central Bank of Kenya (CBK) supervises payment‑type and fiat‑conversion activities, while the Capital Markets Authority (CMA) oversees exchange, trading, and capital‑market‑style functions. In practice:

• CBK: Payment processing in virtual assets, fiat‑to‑virtual‑asset conversion, custodial wallet services, and stablecoin issuance.
• CMA: Virtual asset exchange operation, brokerage, token issuance and tokenisation, and investment advisory or portfolio management involving virtual assets.

Firms conducting activities falling under both regulators will need to apply separately to each, a process sometimes referred to as CBK CMA crypto oversight dual licensing.

Step‑by‑Step Process How to Obtain a VASP Licence in Kenya

The following ten steps reflect the requirements of the VASP Act and the gazetted Regulations. Each step should be treated as a compliance milestone.

1. Step 1 Identify Your Licence Category and Regulator

   Begin by mapping your business activities to the categories in the Act. Common categories include:

   • Virtual Asset Exchange Operator (CMA) matching buy and sell orders for virtual assets.
   • Wallet / Custody Provider (CBK) safeguarding private keys or holding virtual assets on behalf of clients.
   • Stablecoin Issuer (CBK) issuing tokens pegged to fiat or commodities.
   • Virtual Asset Broker (CMA) intermediating trades without operating an order book.
   • Payment Processor (CBK) facilitating payments or remittances in virtual assets and fiat conversions.
   • Token Issuance / Tokenisation Platform (CMA) creating and distributing digital tokens representing assets.
   • Investment Adviser / Asset Manager (CMA) providing advice on or managing portfolios of virtual assets.

   If your platform spans multiple categories, you will file separate applications with CBK and CMA. Early categorisation avoids costly resubmissions.

2. Step 2 Create or Confirm the Kenyan Legal Vehicle

   Applicants must be incorporated (or registered as a branch) in Kenya as a company limited by shares under the Companies Act, 2015. Foreign parents may apply through a locally incorporated subsidiary; in certain cases, group consolidated financial statements from the foreign parent may be relied upon to demonstrate financial soundness, subject to auditor verification. Ensure your Memorandum of Association includes virtual asset activities in the objects clause.

3. Step 3 Meet Capitalisation and Prudential Requirements

   The Regulations prescribe minimum paid‑up share capital and liquid capital thresholds that vary by licence category. These thresholds are designed to ensure operational resilience. Refer to the fee and capital table below for category‑specific numbers. Capital must be fully paid up before the application is submitted, and the applicant must provide a bank confirmation letter from a Kenyan licensed bank.

4. Step 4 Prepare Governance and Fit‑and‑Proper Evidence

   All directors, senior officers, and beneficial owners must pass a fit‑and‑proper test. Documentation includes:

   • Curriculum Vitae: Detailed professional history covering at least ten years.
   • Declarations of Good Standing: Statutory declarations confirming no criminal convictions, insolvency proceedings, or regulatory sanctions.
   • Board Composition: Evidence of independent, non‑executive directors and establishment of an audit committee, risk committee, and compliance function.
   • Beneficial Ownership Disclosure: Full chain of ownership up to the ultimate beneficial owner(s).

   A common pitfall is underestimating the documentation burden for foreign‑resident directors; apostilled police clearance certificates and regulatory references from home jurisdictions are routinely requested.

5. Step 5 Build the AML/CFT Compliance Programme

   VASPs are classified as reporting institutions under POCAMLA. Before filing your licence application, you must have a board‑approved AML/CFT manual, designate a Money Laundering Reporting Officer (MLRO), and demonstrate readiness for customer due diligence, FATF Travel Rule compliance, sanctions screening, and transaction monitoring. See the dedicated AML/KYC section below.

6. Step 6 Establish Operational Controls

   The Regulations require demonstrable operational readiness, including:

   • Custody Arrangements: Clear policies for segregation of client virtual assets from proprietary holdings.
   • IT and Cybersecurity: An independent IT security audit report, penetration testing, and incident‑response procedures.
   • Business Continuity: Disaster recovery and data‑backup plans with defined recovery‑time objectives.
   • Kenyan Bank Account: Proof of a functioning operating account with a CBK‑licensed bank.

7. Step 7 Assemble the Application Pack

   Compile all corporate, financial, governance, AML, IT, and consumer‑protection documents listed in the Regulations’ schedules. Use the downloadable documentation checklist (see below) to verify completeness. Submit in the format prescribed by the relevant regulator CBK and CMA may specify electronic portals or hard‑copy filing requirements in their respective application guidance notices.

8. Step 8 Submit and Navigate Regulator Review

   Upon submission, the regulator has a statutory window to determine whether the application is complete. Expect a formal acknowledgement followed by substantive due diligence queries. Common information requests include additional financial projections, clarification of custodial technology architecture, and supplementary fitness‑and‑propriety checks on newly appointed officers. Timely, well‑prepared responses shorten the review cycle.

9. Step 9 Post‑Licence: the 12‑Month Commence Rule and 36‑Month Transfer Lock

   Two commercially important rules in the Regulations shape post‑grant strategy:

   • 12‑Month Commencement Deadline: A licensee must begin regulated operations within 12 months of licence grant, or the licence may be revoked.
   • 36‑Month Transfer Restriction: A licence cannot be transferred or assigned until at least 36 months after grant, and even then only with prior regulator approval. This locks the licence to the original operator and carries significant implications for fundraising, M&A, and exit planning.

   Industry observers expect the transfer lock to increase the strategic value of early licence applications, as acquirers will need to wait three years before a licence change of control is even eligible for consideration.

10. Step 10 Renewal, Reporting, and Ongoing Supervision

    Licences are subject to annual renewal and ongoing reporting obligations, including audited annual financial statements, quarterly compliance reports, and incident notifications. Both CBK and CMA retain powers of inspection, information requests, and enforcement action for non‑compliance. Budget for continuous compliance costs from the outset.

Comparison Table CBK vs CMA: Who Regulates Which Activities

Understanding the dual‑regulator model is essential for anyone pursuing VASP licensing in Kenya. The table below summarises the activity split established by the Act and the respective supervisory mandates.

Platforms conducting activities under both regulators for example, an exchange that also offers fiat‑conversion wallet services must maintain separate compliance functions and governance reporting lines for each regulator. Managing CBK vs CMA dual oversight effectively is one of the more complex aspects of Kenya’s regime.

Key Requirements and Eligibility for a Kenya VASP Licence

The VASP licence requirements in Kenya are designed to ensure that only financially sound, well‑governed, and AML‑compliant entities participate in the virtual asset ecosystem. The principal eligibility criteria include:

• Paid‑Up Capital and Liquid Capital: Applicants must meet minimum paid‑up share capital thresholds that vary by licence category. The Regulations also prescribe ongoing liquid capital requirements a fraction of operating expenditure that must be maintained at all times. Exact figures are set out in the schedules to the gazetted Regulations (Legal Notice No. 134); press reporting indicates thresholds of up to KES 500 million for the highest‑risk categories.
• Fit‑and‑Proper Tests: Every director, senior officer, and person holding 10 per cent or more of voting rights must satisfy fit‑and‑proper criteria, including integrity, competence, and financial soundness. Background checks, police clearance, and regulatory references are standard.
• Kenyan Presence Requirements: Applicants must maintain a physical office in Kenya with adequate staffing and hold an operating account with a CBK‑licensed bank. The Act also has extraterritorial reach: foreign firms targeting Kenyan customers must be licensed even if their servers or headquarters are located abroad.
• Corporate Governance and Consumer Protection: Licensees must segregate client assets from proprietary assets, maintain an independent complaint‑handling mechanism, and comply with advertising restrictions that prohibit misleading claims about virtual asset returns or risks.
• Group Financial Reliance: Where a Kenyan applicant is a subsidiary of a foreign parent, the regulator may accept consolidated group financial statements to demonstrate financial soundness, provided these are audited by a recognised audit firm and accompanied by a parent‑company guarantee or comfort letter. Three years of audited financials are typically required; start‑ups may submit opening financial statements verified by an auditor together with detailed financial projections.

Fees and Cost Table

The fee schedule is gazetted in the Regulations (Legal Notice No. 134 of 2026). The table below summarises the principal fee categories. Applicants should confirm the final amounts against the published Kenya Gazette text before budgeting.

Source: Schedules to the VASP Regulations, 2026 (National Treasury publication). Confirm final figures against the Kenya Gazette before submission.

Application fees are non‑refundable. Multi‑category applicants pay fees for each category. Budget for additional costs including legal fees, auditor verification, IT security audit, and compliance technology.

AML / KYC / Reporting Obligations

AML obligations for VASPs in Kenya are substantial and tightly prescribed. The VASP Act expressly designates virtual asset service providers as reporting institutions under the Proceeds of Crime and Anti‑Money Laundering Act (POCAMLA). This designation triggers the full range of Kenyan AML/CFT duties and aligns Kenya with the FATF Updated Guidance for a Risk‑Based Approach to Virtual Assets and VASPs.

The minimum required AML programme includes:

• Customer Due Diligence (CDD): Identity verification before account opening, enhanced due diligence for high‑risk customers (PEPs, complex ownership structures, high‑value transactions), and ongoing monitoring of the customer relationship.
• Travel Rule Compliance: Originator and beneficiary information must accompany virtual asset transfers above prescribed thresholds. VASPs must implement technical solutions capable of transmitting and receiving Travel Rule data from counterparty VASPs.
• Suspicious Transaction Reporting (STR): All suspicious transactions and attempted transactions must be reported to the Financial Reporting Centre (FRC) without tipping off the customer.
• Sanctions Screening: Real‑time screening against UN, Kenyan, and other applicable sanctions lists at onboarding and on an ongoing basis.
• Transaction Monitoring: Automated systems calibrated to the VASP’s risk profile to detect unusual patterns, structuring, and rapid movement of funds.
• Record Retention: All CDD records, transaction data, and internal reports must be retained for at least seven years after the business relationship ends.
• Regulator Inspections: CBK and CMA may conduct on‑site AML inspections at any time. The MLRO must be available and records must be accessible within Kenya.

A dedicated Kenya VASP AML & KYC compliance checklist is available for applicants preparing their programme documentation.

Documentation Checklist

The application pack required by the Regulations is extensive. Below is a summary of the principal document categories. A downloadable VASP Application Checklist (GLE template, PDF) is available for applicants who need a working document to track preparation and assembly.

• Corporate Documents: Certified copies of the Certificate of Incorporation, Memorandum and Articles of Association, CR12 (Company Registrar extract), and beneficial ownership register.
• Governance & Personnel: Board resolution authorising the application, CVs and fit‑and‑proper declarations for all directors and senior officers, organisational chart, and appointment letters for MLRO, compliance officer, and chief technology officer.
• Financial Statements: Three years of audited financial statements (or opening financials verified by an auditor for newly incorporated entities), evidence of paid‑up capital, and three‑year financial projections with assumptions.
• AML/CFT Documentation: Board‑approved AML/CFT manual, customer onboarding procedures, Travel Rule implementation plan, sanctions screening policy, STR filing procedures, and evidence of FRC registration.
• IT & Cybersecurity: Independent IT security audit report (no older than six months), penetration test results, data protection impact assessment, business continuity plan, and disaster recovery procedures.
• Consumer Protection: Complaint‑handling policy, client asset segregation policy, terms and conditions (draft), advertising compliance guidelines, and risk disclosure statements.
• Third‑Party Contracts: Copies of material outsourcing arrangements, technology vendor agreements, and custodial service contracts (where applicable).
• Bank Confirmation: Letter from a CBK‑licensed bank confirming the applicant’s operating account and the deposit of minimum paid‑up capital.
• Auditor Verification: Letter from the appointed external auditor confirming willingness to act and verifying capital adequacy.

Timelines, Review Milestones, and Timeline Graphic

While each application is assessed on its merits, the Regulations provide a framework for expected processing stages. The VASP Regulations include a 30‑day statutory window within which the regulator must determine whether an application is complete.

The indicative stages and realistic timeframes are:

• Application Submission & Completeness Check: 30 days (statutory). The regulator may request supplementary documents; incomplete applications are returned.
• Substantive Review (CBK or CMA): 60–120 days. Includes due diligence on directors, review of AML systems, and assessment of financial adequacy.
• Pre‑Approval Conditions: The regulator may impose conditions (e.g., appointment of an additional independent director, enhancement of IT controls) before granting the licence.
• Licence Grant: Formal issuance of the VASP licence, published in the Kenya Gazette.
• 12‑Month Commence Deadline: Operations must begin within 12 months or the licence lapses.
• 36‑Month Transfer Lock: No assignment or transfer of the licence for 36 months post‑grant.

Suggested timeline graphic alt text: “VASP licence application timeline Kenya application to 36‑month transfer lock milestones.”

In practice, well‑prepared applications with complete documentation and responsive applicants may receive a decision within four to six months. Poorly assembled packs or complex multi‑category filings can take considerably longer.

Practical Next Steps and Checklist for the First 90 Days

Applicants seeking to move quickly should adopt the following 90‑day action plan:

• Days 1–15: Incorporate the Kenyan entity (or confirm existing entity suitability), open a bank account with a CBK‑licensed bank, and engage external auditors.
• Days 15–30: Appoint directors and senior officers, commission fit‑and‑proper background checks, and finalise the organisational chart.
• Days 30–45: Draft the AML/CFT manual, prepare the IT security audit, and commission penetration testing.
• Days 45–60: Assemble the full documentation pack using the downloadable checklist. Engage legal counsel to review completeness and pre‑submit to the regulator informally where possible.
• Days 60–75: Submit the application and application fee. Begin preparing responses to anticipated regulator queries.
• Days 75–90: Address regulator feedback, finalise governance appointments, and begin operational readiness in parallel.

Funding and investor considerations: Given the 36‑month transfer restriction, founders and investors should structure shareholder agreements with VASP licence‑lock provisions. Consider shareholder protections such as tag‑along/drag‑along rights conditioned on regulator consent, escrow of licence‑sensitive shares, and investor consent requirements for material changes to the licensed entity’s board or capital structure.

Check eligibility with GLE’s Kenya counsel to receive a tailored assessment of your readiness against the Regulations’ requirements.

Sources

• Virtual Asset Service Providers Act, 2025 Kenya Law
• Central Bank of Kenya Public Notice on the Virtual Assets Service Providers Act 2025
• Capital Markets Authority Commencement of the Virtual Assets Service Providers Act 2025
• National Treasury Draft Virtual Asset Service Providers Regulations, 2026 (Clean Copy)
• Proceeds of Crime and Anti‑Money Laundering Act (POCAMLA) Kenya Law
• FATF Updated Guidance for a Risk‑Based Approach to Virtual Assets and VASPs (2021)
• Business Daily Africa New rules set up to Sh500m capital for crypto firms