Kenya’s FinTech sector has grown rapidly, positioning the country as one of Africa’s leading markets for digital financial services, mobile payments and emerging financial technologies. This growth has increasingly extended to virtual assets, including crypto-assets, digital tokens, virtual asset exchanges and blockchain-based financial products. While these innovations offer opportunities for investment and financial inclusion, they have also raised concerns about consumer protection, money laundering, market integrity, cybersecurity and financial stability. These developments contributed to the enactment of the Virtual Asset Service Providers Act, 2025, and its accompanying regulations.  

On 22 July 2026, the Cabinet Secretary for the National Treasury gazetted the Virtual Asset Service Providers Regulations, 2026, thereby giving full operational effect to Kenya’s first comprehensive licensing and supervisory framework for Virtual Asset Service Providers (VASPs).  

The timing is significant. The Act commenced on 4 November 2025, giving existing operators one year to regularise their operations and obtain the requisite licence. With the deadline on 4 November 2026, VASPs now have less than one month to become compliant. For businesses already operating in the market, compliance is an immediate regulatory priority.  

Importantly, the Regulations apply to persons providing virtual asset services “in or from Kenya.” This extends beyond locally incorporated businesses. Foreign platforms that actively target Kenyan consumers or derive economic benefit from Kenya may also fall within the regulatory perimeter, even if they have no physical presence in the country.  

What Services Are Licensable?  

The Regulations establish 10 distinct licensing categories, with supervision divided between the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA). Businesses should therefore map their actual activities against the regulatory categories rather than relying solely on their corporate descriptions or existing licences.  

The financial threshold for entry will depend significantly on the activity undertaken. Minimum paid-up capital ranges from KSh10 million for certain categories, including brokers, payment processors and ICO providers, to KSh300 million for stablecoin issuers. Exchanges require at least KSh100 million, while wallet providers require KSh150 million.  

Applicants must also demonstrate adequate liquid capital and, where multiple licences are held, maintain capital applicable to the highest-capital category plus 50% of the paid-up capital required for each additional activity.  

The licensing process is equally substantive. Applicants must provide information on directors, senior officers, significant shareholders, and beneficial owners, alongside business plans, fit-and-proper documentation, source-of-funds evidence, and policies covering AML/CFT/CPF, data protection, cybersecurity, consumer protection, complaints management, conflicts of interest, and business continuity.  

Exchanges and token issuance platforms must additionally demonstrate appropriate market rules covering matters such as market integrity, order matching, settlement and dispute resolution. Applicants must also submit audited financial statements or opening statements, an independent information-systems audit and vulnerability assessment and penetration-testing reports.  

The CBK-CMA Division of Responsibilities  

Kenya has adopted a dual-regulator model, reflecting the different risks presented by virtual asset activities. Correctly identifying the responsible regulator will be critical for operators preparing applications.  

The CBK’s mandate focuses primarily on activities with implications for payments, monetary stability and the financial system. Stablecoin issuers consequently face particularly stringent requirements. Stablecoins must be fully backed by reserve assets of equivalent nominal value, held in segregated pools. Holders must be able to redeem their holdings at par value within two working days, while issuers must undertake stress testing, independent reserve audits and regular reporting to the CBK.  

The CMA, meanwhile, oversees activities with a stronger investment, trading and capital-markets dimension. This includes exchanges, brokers, investment advisers, managers and tokenisation activities.  

The framework also introduces a Virtual Assets Services Coordination Forum, bringing together 20 public agencies, including the National Treasury, CBK, CMA, Financial Reporting Centre, Asset Recovery Agency and Office of the Data Protection Commissioner (ODPC). The Forum is intended to facilitate information sharing and coordinated supervision across the regulatory landscape.  

Beyond licensing, VASPs will face continuing obligations. Consumer assets must be segregated from the provider’s own assets, regular reconciliations must be undertaken, and consumers must receive appropriate disclosures on fees, risks, licensing status and complaints mechanisms. Cybersecurity obligations include regular vulnerability assessments, penetration testing, incident-response arrangements and reporting of significant cybersecurity incidents within prescribed timelines.  

Way Forward  

With less than one month before the 4 November 2026 deadline, existing VASPs should treat licensing as an immediate board-level compliance priority. Businesses should first undertake a regulatory-perimeter assessment to determine precisely which activities they conduct and whether they fall within the definition of operating “in or from Kenya.”  

They should then identify the appropriate regulator, assess capital adequacy, close governance and documentation gaps and prepare the full licensing application. Particular attention should be given to beneficial-ownership information, AML/CFT/CPF controls, cybersecurity assessments, consumer-protection measures, source-of-funds documentation and business-continuity arrangements.  

Foreign platforms should not assume that incorporation outside Kenya removes them from the regime. Platforms targeting Kenyan users, accepting Kenyan customers or deriving economic benefit from Kenyan transactions should urgently assess whether they require a Kenyan licence.  

For investors and consumers, the new framework provides an important due-diligence tool. Before engaging a VASP, users should establish whether the provider is appropriately licensed, understand the risks associated with the service and verify the available complaints and redress mechanisms.  

The introduction of the Regulations marks a significant shift in Kenya’s virtual asset market from an emerging and relatively lightly regulated sector to a formally supervised financial-services environment. The compliance clock is now effectively at one month. Operators that have not commenced their licensing preparations should act immediately, as capital restructuring, governance changes, independent audits and regulatory documentation cannot be completed reliably at the last minute.  

The next phase will therefore be defined not by whether Kenya regulates virtual assets, but by how effectively businesses adapt to the new regulatory expectations while continuing to support responsible innovation in the country’s rapidly evolving FinTech ecosystem.