Kenya's Crypto Licensing Deadline Is 4 November 2026, and No Licence Register Has Been Published

The short version: Existing virtual asset service providers in Kenya must comply with the VASP Act 2025 by 4 November 2026. Section 47 gives anyone who was already providing virtual asset services when the Act commenced on 4 November 2025 one year to comply (Act, s. 47); one year on is 4 November 2026 by our calculation. As of 22 Oct 2026, no VASP licence register has been published by the CBK or the CMA, and the CMA's online licensee directory has no virtual-asset category among its 19 licence types (CMA directory).

How Kenya Got Here

Parliament passed the Virtual Asset Service Providers Act, 2025; the President assented on 15 October 2025, it was published in the Kenya Gazette on 21 October and it commenced on 4 November 2025 (Kenya Law). Two weeks later the CBK and the CMA issued a joint public notice: licensing would start only once the National Treasury issued Regulations, and “currently CBK and CMA have not licensed any VASPs under the Act” (CBK/CMA notice, 18 Nov 2025).

The Treasury published draft Regulations with a Regulatory Impact Statement on 17 March 2026, took written comments until 10 April and held public forums in eleven towns from Mombasa to Kitale between 30 March and 10 April (Treasury notice). The final Virtual Asset Service Providers Regulations, 2026 were made by the Cabinet Secretary on 3 July and published as Legal Notice 134 on 22 July 2026, commencing the same day (Kenya Law). That left 105 days, about fifteen weeks, between the final rulebook and the end of the transition. The Act had already been in force for 260 days when the Regulations arrived; under the regulators' November notice, licensing could only start once they did.

What “Comply by 4 November” Means

Section 47 does not say “apply by” or “be licensed by”; it says existing providers shall “comply with the provisions of this Act”. The central provision is section 8(2): no virtual asset business in or from Kenya without a licence. Read together, an existing operator without a licence after 4 November 2026 is exposed to the section 8(3) offence. Neither the Act nor the Regulations says what happens to an operator whose application is still being processed on that date: there is no provision allowing it to keep trading, and no published regulator guidance on the point that we could find. The Regulations themselves contain no transitional clause at all.

The 30-Day Clock

Once a regulator has every required document and has finished its due diligence, it must decide within thirty days (Regulations, reg. 6(4)). Counting back thirty days from 4 November gives 5 October 2026: an application that only became complete after that date had no guarantee of a decision by the deadline even on the regulators' own timetable. Because the clock starts only after due diligence, an earlier filing is no guarantee either. Each grant must then be published in the Kenya Gazette within thirty days (Act, s. 10(7)) and entered in a register that each regulator must post on its website (Act, s. 17).

What an Application Contains

Regulation 6(2) lists 21 items. Among them: personal details of directors, senior officers, significant shareholders and beneficial owners; a business plan; fit-and-proper forms; proof of source of funds; nine named policies, from AML/CFT/CPF to business continuity; evidence of paid-up and liquid capital; three years of audited accounts (or audited opening accounts for a new company), plus the parent's consolidated accounts for a foreign-owned subsidiary; an independent information-systems audit with a vulnerability assessment and penetration test; and full disclosure of cross-border operations and licences elsewhere (Regulations, reg. 6(2)). The regulator can call the applicant to an interview, and can reject an application if the applicant does not attend or does not answer requests for information (Regulations, regs. 6(3), 10).

What Happens After 4 November

• Criminal exposure. A fine of up to KSh 25 million for a company; a fine of up to KSh 10 million or imprisonment for up to five years, or both, for an individual (Act, s. 40(3)). A director, partner or senior officer who knowingly authorised, permitted or aided an offence by the licensee is liable too (Act, s. 41).
• Advertising. Advertising or promoting a virtual asset service other than in line with the Regulations draws an administrative fine of up to KSh 5 million for a company (Regulations, regs. 123, 142).
• Licence year. Every licence expires on 31 December of the year it is issued (Act, s. 13) and renewal must be filed at least two months before expiry (Regulations, reg. 11(2)). A licence granted in November 2026 therefore runs for weeks, and the renewal for 2027 falls due by 31 October.

What We Check

This hub reads the CMA licensee directory on every build and will list licensees as soon as either regulator publishes a register or gazettes a grant. All ten licence categories, with capital and fees.