Analysis
Kenya's Crypto Rules Reach Foreign Exchanges: Office, CEO and a Stablecoin Listing Ban
The “in or from Kenya” test, what a foreign group must set up locally, and the rule on listing stablecoins.
The short version: Kenya's rules reach platforms that have no office in the country. A provider is treated as operating “in or from Kenya” if it actively solicits or targets local consumers, or derives an economic benefit or income from Kenya, “regardless of whether the person has physical presence in Kenya or not” (Regulations, reg. 4(2)). To be licensed, it then needs a Kenyan footprint: a registered company, an office, a bank account and a chief executive domiciled in Kenya.
The Territorial Test
The Act applies to providers offering virtual asset services in Kenya (Act, s. 4(1)) and makes unlicensed business “in or from Kenya” an offence (Act, s. 8(2)). Regulation 4(2) defines the phrase by conduct and economic benefit rather than by where the company sits. A foreign exchange that markets to Kenyans, or earns fees from Kenyan users, falls inside on the plain wording. The Regulations do not set a revenue threshold, a user count or a reverse-solicitation exemption.
What a Foreign Group Must Set Up
- A licensable company. A Kenyan company limited by shares, or a foreign company limited by shares registered under the Companies Act (Act, s. 8(1)).
- A physical office in Kenya where its business is carried out (Act, s. 19), and client and own transaction records kept at its principal place of business for at least seven years (Act, s. 44(2)).
- A Kenyan bank account (Act, s. 24(h)).
- A chief executive domiciled in Kenya, approved by the regulator (Act, s. 30; Regulations, reg. 44(c)).
- Group disclosure. Audited consolidated accounts of the foreign parent for three years and full disclosure of cross-border operations, affiliates and regulatory status elsewhere (Regulations, reg. 6(2)(j), (m)). A record of regulatory breaches in any jurisdiction where the applicant is or was licensed is a ground for rejection (Regulations, reg. 10(d)).
- Real-time access. The regulator can require online, real-time, read-only access to client and own transaction records (Act, s. 44(1)).
The Stablecoin Listing Rule
A licensed exchange “shall not list any stablecoin unless that stablecoin has been approved by the Central Bank of Kenya and is issued by a duly licensed stablecoin issuer” (Regulations, reg. 60(6)). Read literally, that covers dollar stablecoins issued abroad as well as any Kenya-shilling coin. A Kenyan stablecoin licence carries its own conditions: full reserve backing in cash, short government paper or repos, at least 30% of funds held in trust accounts at Kenyan banks with the rest invested in Kenya, redemption at par within two working days and no interest for holders (Regulations, regs. 71, 72, 75, 77). The regulator can also order a token delisted for financial-stability or consumer-protection reasons (Regulations, reg. 60(7)).
Banned Services
Mixers, tumblers and other anonymity-enhancing services are prohibited outright for licensees, on pain of the same penalties as unlicensed business (Act, ss. 21, 40(3)). Every transaction record must keep wallet addresses, chain identifiers and interaction logs (Regulations, reg. 22(2)).
Marketing to Kenyans
Advertising or promoting a virtual asset service, including token offerings and NFTs, other than in line with the Regulations is prohibited, and a licensee answers for influencers and other third parties who promote on its behalf as if it had published the advert itself (Regulations, reg. 123). Cold calling to solicit business is restricted (Regulations, reg. 122).
What This Page Does Not Say
We do not assess whether any named platform currently targets Kenyan users or has applied for a licence. Regulators have not published applicant names, and section 42 of the Act bars them from disclosing information about applicants except in limited cases, such as statistics that do not identify anyone.
How Kenya Compares
Where Kenya stands: upcoming (4 Nov 2026 · transition ends). Other jurisdictions in the Middle East and Africa that VASP Tracker follows, nearest deadlines first:
| Jurisdiction | Framework | Status | Key date |
|---|---|---|---|
| Ghana | VASP Act 2025 | Date not set | — |
| United Arab Emirates | CBUAE Decree-Law 6/2025 | In force / passed | 16 Sep 2026 · transition ends |
| South Africa | FAIS CASP licensing | In force / passed | 31 Mar 2026 · regulator notice |
| Nigeria | ISA 2025 | In force / passed | 25 Mar 2025 · in force |
| Seychelles | VASP Act 2024 | In force / passed | 31 Dec 2024 · application deadline |
| Bahrain | CRA module | In force / passed | 25 Feb 2019 · rules published |
Statuses and dates come from the official sources cited on each jurisdiction's page. All 76 jurisdictions on one map
Sources
- VASP Act 2025 (Kenya Law) new.kenyalaw.org
- VASP Regulations 2026, LN 134 (CMA PDF) www.cma.or.ke
- CBK/CMA public notice, 18 Nov 2025 www.centralbank.go.ke
- Draft VASP Regulations, 17 Mar 2026 www.cma.or.ke