Kenya's One-Year Transition for Existing Crypto Providers Under the VASP Act Ends

The one-year window that Kenya's Virtual Asset Service Providers Act, 2025 gave to businesses already offering crypto services closed on 4 November 2026. Section 47 of the Act, which commenced on 4 November 2025, requires any person providing virtual asset services at commencement to comply with the Act within one year. From now on, existing exchanges, custodial wallet providers, brokers and other operators serving the Kenyan market have no statutory grace period left: carrying on, purporting to carry on, or holding out as carrying on virtual asset business in or from Kenya without a licence from the Central Bank of Kenya (CBK) or the Capital Markets Authority (CMA) is a criminal offence.

The deadline arrives 105 days after the implementing rulebook, the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), was published in the Kenya Gazette and took effect on 22 July 2026. Neither the Act nor the Regulations contains a provision allowing an operator whose application is still pending to keep trading after the transition ends.

What the Law Now Requires

Section 8(2) of the Act provides that a person shall not carry on, or purport to carry on, the business of virtual asset services, or hold itself out as carrying on that business in or from Kenya, unless it is licensed by the relevant regulatory authority. Only a company limited by shares registered under the Companies Act, or a foreign company registered under that Act, is eligible to apply (s. 8(1)). Under section 40(3), a conviction for the section 8(3) offence carries a fine of up to KSh 25 million for a company, and for an individual a fine of up to KSh 10 million, imprisonment of up to five years, or both. Section 41 extends liability to any director, partner or senior officer who knowingly authorised, permitted or aided the offence.

The Regulations define the territorial reach broadly. Regulation 4(2) treats a person as operating in or from Kenya where it actively solicits or targets local consumers, or derives an economic benefit or income from Kenya, regardless of whether it has a physical presence in the country. Foreign platforms with Kenyan customers are therefore within scope, not only locally incorporated firms.

Licensing is split by activity in the Act's First Schedule. The CBK is responsible for custodial wallet providers, virtual asset payment processors and stablecoin issuance. The CMA covers exchanges and trading platforms, brokers, investment advisers, managers and virtual asset offerings such as initial coin offerings, tokenisation and token issuance platforms.

Capital, Fees and the Licensing Timetable

The Fifth Schedule to the Regulations sets paid-up capital floors that applicants must evidence. A virtual asset exchange needs KSh 100 million paid-up capital and liquid capital of KSh 20 million or 8% of total liabilities, whichever is higher. A custodial wallet provider needs KSh 150 million, a stablecoin issuer KSh 300 million, a broker or payment processor KSh 10 million, and an investment adviser has no capital requirement. Under the First Schedule, the application fee is KSh 100,000 for most categories and the licence fee ranges from KSh 50,000 for an investment adviser to KSh 1 million for an exchange and KSh 2 million for a stablecoin issuer.

Regulation 6(4) requires the regulator to decide an application within thirty days of receiving all required documents and information and completing its due diligence, so the clock does not start on filing. Once a licence is granted, the regulator must publish a notice of the grant in the Kenya Gazette within thirty days (s. 10(7)), and each regulator must keep a register of licences and publish an updated copy on its website (s. 17). A licence expires on 31 December of the year in which it is issued (s. 13), and a renewal application must be lodged at least two months before expiry (reg. 11(2)), which means licences granted in the coming weeks will need renewing almost immediately.

Where Licensing Stands and What Comes Next

In their joint public notice of 18 November 2025, the CBK and the CMA said that licensing would begin only once the National Treasury issued Regulations, and that they had not licensed any VASPs under the Act. That notice remains the latest VASP-specific item on the CMA's public-notice page. When checked on 4 November 2026, neither regulator's website showed a published register of VASP licences under section 17, and no gazetted licence grant was found.

The next public signals will therefore be gazette notices of licence grants, the first section 17 registers on the CBK and CMA websites, and any statement from either regulator on operators that have not complied. The Regulations also give the authorities administrative tools: a fine of up to KSh 5 million for a company that breaches listed provisions, and the power to suspend or revoke a licence or issue remedial directions (reg. 142). Platforms serving Kenyan users without a licence now face enforcement risk under the Act, and customers can check a provider's status against the registers once they are published.