How to Get a VASP License in Kenya: CBK or CMA, the Application File and the 30-Day Clock

The short version: A crypto business that serves Kenya needs a licence under the Virtual Asset Service Providers Act, 2025. It applies to the Central Bank of Kenya or the Capital Markets Authority, depending on the activity, on the form in the Second Schedule to the VASP Regulations, 2026 (Regulations, reg. 6(1)). The Regulations have been in force since 22 July 2026 (Kenya Law). Existing operators must comply by 4 November 2026 (our calculation from Act, s. 47). This guide follows the procedure step by step and links to our separate pages on the deadline, capital and fees and local-presence rules.

A summary of the Act and Regulations linked in each paragraph. Not legal advice. VASP Tracker is an independent project with no connection to the CBK, the CMA or the National Treasury.

Step 1: Identify Your Activity and Your Regulator

The Act's First Schedule assigns each licensable activity to one of the two regulators. The CBK licenses Stablecoin Issuer, Virtual Asset Wallet Provider, Virtual Asset Payment Processor. The CMA licenses Virtual Asset Exchange, Initial Coin Offering Provider, Token Issuance Platform, Virtual Asset Manager, Tokenization Provider, Virtual Asset Broker, Virtual Asset Investment Advisor (Act, First Schedule). Each category has its own capital, fee and renewal rules, so start by mapping every product to a category. An exchange that also holds client coins is carrying out two activities, not one.

A single licence can cover more than one activity. The regulator decides this case by case, depending on whether the lines of business are distinct or share infrastructure, risk profile and operational control (Regulations, reg. 6(5)). The two regulators may also license and supervise jointly (Regulations, reg. 148). The Regulations do not set out a procedure for a firm whose activities fall under both the CBK and the CMA, and we found no published guidance on whether such a firm files once or twice.

A separate permission applies to converting virtual assets to or from foreign currency. Before starting that business, a firm must apply in writing to the CBK for authorisation. The CBK considers the applicant's financial condition and history and must notify its decision within ten days of making it. The authorisation expires on 31 December each year, renewal is due two months before expiry, and operating without it draws an administrative sanction (Regulations, regs. 14 to 16).

Step 2: Set Up the Kenyan Company

Only a company limited by shares can hold a licence. That means a Kenyan company, or a foreign company registered under the Companies Act (Act, s. 8(1)). The application form asks for the certificate of incorporation, the CR12 (the Registrar of Companies' record of directors and shareholders) and the BOF1 beneficial-ownership form. It also asks for the KRA PIN, a tax compliance certificate and a physical office address in Kenya down to the land reference number and a map pin (Regulations, Second Schedule). The Act also requires an office in Kenya (Act, s. 19) and a Kenyan bank account (Act, s. 24(h)). The form asks for the bank's confirmation letter. A foreign group should read our page on the rules for foreign exchanges: the “in or from Kenya” test in Regulations, reg. 4(2) reaches platforms with no Kenyan office.

Step 3: Appoint the Board and Key Officers

• Board. At least three directors, one-third of them independent, with no more than one-third related to another director. The chair or a director may not be the chief executive (Regulations, reg. 42). Under the Act, a director may sit on the boards of no more than two VASPs (Act, s. 20).
• Chief executive. Must be fit and proper under section 18, competent in virtual assets or a relevant field, and domiciled in Kenya (Regulations, reg. 44; Act, s. 30).
• Compliance officer. Appointed by the board, with direct access to it and no role in the functions being monitored (Regulations, reg. 39).
• Finance and internal audit. The people in charge must be members of ICPAK or an equivalent international body that ICPAK recognises (Regulations, reg. 45).

Every director, the CEO and each senior officer completes a fit-and-proper form, and so does each significant shareholder and beneficial owner. These are in the Fourth Schedule. Individual significant shareholders and directors also sign a declaration on the sources of their funds, certified by an advocate or a commissioner for oaths (Regulations, Second and Fourth Schedules). A regulator may reject an application if any director, senior officer or beneficial owner fails the fit-and-proper test (Regulations, reg. 10(c)).

Step 4: Put the Capital, Insurance and Fees in Place

Minimum paid-up capital ranges from nil for an investment adviser to KSh 300 million for a stablecoin issuer. An exchange needs KSh 100 million, and a custodial wallet provider KSh 150 million (Regulations, Fifth Schedule). The applicant must show evidence of paid-up and liquid capital with the file (Regulations, reg. 6(2)(h)). Insurance must cover clients' virtual assets, plus cyber risk, theft and loss of keys, and the insurer must be licensed in Kenya or approved by the regulator (Regulations, reg. 88). The application fee is KSh 100,000 for most categories, KSh 50,000 for a manager and KSh 10,000 for an adviser. It is paid up front and forfeited if the application is withdrawn (Regulations, reg. 5(2), First Schedule). The licence fee is paid only on grant (Regulations, reg. 7). Figures for every category, and the formula for holding more than one licence, are on our capital and fees page and the Kenya register.

Step 5: Assemble the Application File

The Second Schedule form has five parts:

• Part A: general and contact details, other offices in Kenya, countries of operation, parent company and subsidiaries.
• Part B: the activities applied for.
• Part C: shareholders, directors and senior officers.
• Part D: capital structure, insurance, bankers, custodians and other service providers, wallet holdings or the list of tokens to be listed, operational capability, policies, financial statements and sources of funding.
• Part E: a declaration signed by two directors before a commissioner for oaths or a magistrate.

The form then lists 29 required attachments (Regulations, Second Schedule).

Regulation 6(2) sets out what must accompany the application, items (a) to (u). The items that take the longest to prepare are usually these:

• A business plan in the Third Schedule format. Twelve headings in a fixed order, from governance and technology (including hot and cold wallet set-up) to a risk register, financial projections for three to five years, safeguarding of client assets and a three-year rollout table.
• Nine named policies, among them AML/CFT/CPF, data protection, cybersecurity, complaints, market conduct, consumer protection, conflicts of interest, and business continuity and disaster recovery.
• Audited financial statements for three years, or audited opening accounts for a new company, plus three years of the parent's consolidated accounts for a foreign-owned subsidiary.
• An independent information-systems audit with a vulnerability assessment and penetration test.
• Business rules, required for exchanges, token issuance platforms, offerings and wallet providers.
• Full disclosure of cross-border operations and licences held elsewhere.
• Proof of payment of the application fee.

Sources: Regulations, reg. 6(2), Third Schedule. The form's own financial-statements item asks for two years, while regulation 6(2)(i) asks for three. The regulation is the higher requirement.

Step 6: Lodge, Answer Questions, Wait for the Clock

The application goes to the relevant regulator (Regulations, reg. 6(1)). Neither the CBK nor the CMA had published an online portal, a filing address or application guidance specific to virtual assets when we checked the two regulators' websites on 27 October 2026. The contacts the regulators published in their joint notice when the Act commenced are [email protected] for the CBK and [email protected] for the CMA (CBK/CMA notice). That notice predates the Regulations and does not describe a filing channel.

The regulator may call the applicant to an interview (Regulations, reg. 6(3)). While the application is pending, the applicant must report in writing, within two days, any change to the information filed and any material event. Examples include litigation, a cyber incident, a liquidity shortfall, an enforcement action, or a change in ownership, business model or senior officers (Regulations, reg. 9). A false or misleading statement, or a misleading omission, is an offence (Regulations, regs. 12, 143; Act, s. 40(2)).

The regulator must decide within thirty days of receiving every required document and completing its due diligence (Regulations, reg. 6(4)). The Regulations do not limit how long due diligence may take. An application can be rejected on any of the following grounds (Regulations, reg. 10):

• the applicant ignores requests for information or an interview;
• someone fails the fit-and-proper test;
• the applicant has a record of regulatory breaches in Kenya or in another jurisdiction where it is or was licensed as a VASP;
• approval would pose a risk to financial stability.

Step 7: Grant, Gazette and Go Live

An applicant that meets section 11 of the Act receives its licence on payment of the licence fee (Regulations, reg. 7). The grant must be published in the Kenya Gazette within thirty days (Act, s. 10(7)), and each regulator must keep a register of licensees on its website (Act, s. 17). The licensee must start business within twelve months of the grant (Regulations, reg. 8).

After the Licence

• Annual cycle. Every licence expires on 31 December of the year it is issued (Act, s. 13). Renewal must be lodged at least two months before expiry, on the Second Schedule renewal form with the renewal fee (Regulations, reg. 11).
• Monthly reporting. By the tenth day of each month, the licensee reports transfer volumes and values, fraud and theft, service interruptions and security breaches, and complaints (Regulations, reg. 26(2)).
• No quick resale. A licence can be assigned or transferred only with approval, after at least 36 months of business. A transfer without approval is void (Regulations, reg. 13).
• Records. Records are kept for at least seven years, and the regulator can require real-time read-only access to them (Act, s. 44).

The 4 November 2026 Deadline

Section 47 gives providers that were operating when the Act commenced one year to comply, which by our count ends on 4 November 2026. Neither the Act nor the Regulations says what happens to an application still pending on that date, and we found no regulator guidance on the point. Unlicensed business is an offence, punishable by a fine of up to KSh 25 million for a company (Act, ss. 8, 40(3)). The timing, including the 5 October cut-off implied by the thirty-day clock, is covered in our deadline article.

Is There a Licence Register Yet?

No. No VASP licence register has been published by the CBK or the CMA, and the CMA's online licensee directory has no virtual-asset category (CMA directory, checked 27 Oct 2026). We do not search the Kenya Gazette itself (see the methodology), but grants must also be entered in the regulators' registers. The regulators have not published the number or names of applicants. Section 42 of the Act restricts what they may disclose about applicants. The Kenya register page will list licensees from official sources once they appear.

Kenya, Nigeria and South Africa

• Nigeria. Firms go through the SEC's accelerated incubation programme first. 14 firms hold an Approval-in-Principle, which the SEC says is not a final licence (our Nigeria analysis).
• South Africa. Crypto firms are licensed by the FSCA as financial services providers under the FAIS Act, and its list shows 298 licensed crypto asset service providers (our South Africa analysis).
• Kenya. One dedicated statute and two regulators. There is no incubation stage, and the full rulebook was published only 105 days before the deadline.

The full three-country comparison.

Practical Checklist Before You File

1. Map each product to a First Schedule category, and note which regulator covers it.
2. Incorporate the company, or register the foreign company, and obtain the CR12, the BOF1 and a tax compliance certificate.
3. Secure an office in Kenya and a Kenyan bank account, with the bank's confirmation letter.
4. Appoint a board of at least three, one-third independent, a CEO domiciled in Kenya, a compliance officer and ICPAK-qualified finance and audit heads.
5. Collect fit-and-proper forms and source-of-funds declarations from every director, officer, significant shareholder and beneficial owner.
6. Fund the paid-up and liquid capital and arrange the insurance.
7. Write the Third Schedule business plan, the nine policies and, where required, the business rules.
8. Commission the independent information-systems audit and penetration test.
9. Pay the application fee and have two directors sign the declaration before a commissioner for oaths.
10. Diarise the two-day change notices, the renewal two months before 31 December, and the monthly reports.

Every fee, date and requirement above comes from the Act, the Regulations or the CBK/CMA notice; where something is not public, we say so.