Kenya completed its regulatory framework for the digital asset sector. On 24th July 2026, the Virtual Asset Service Providers (VASP) Regulations, 2026 were published in Kenya Gazette Supplement No. 185 as Legal Notice No. 134, operationalising the Virtual Asset Service Providers Act, 2025, which was assented to in October 2025. This follows a public consultation process that closed in April 2026 and gives Kenya, one of Africa’s largest crypto markets by transaction volume, its first comprehensive licensing regime for virtual asset businesses.
The Regulations do not confine themselves to businesses physically based in Kenya. Under Regulation 4, a provider is deemed to operate “in or from Kenya” if it actively targets Kenyan consumers or derives economic benefit from Kenya, irrespective of physical presence. This is a deliberately wide net: offshore exchanges and platforms serving Kenyan users without any local office may still fall within the licensing regime, provided the targeting or economic-benefit threshold is met. Businesses that have treated Kenya as a market they can serve remotely without local registration will need to revisit that assumption.
Regulation 6 sets a rigorous bar for licence applicants, who must submit detailed particulars on directors, beneficial owners, and significant shareholders, together with governance arrangements, AML/CFT policies, cybersecurity measures, and data protection policies. The message is unambiguous: regulators expect VASPs to meet governance standards comparable to those imposed on regulated financial institutions, not the lighter-touch expectations often associated with fintech startups.
Supervisory responsibility is split between two regulators. The Central Bank of Kenya supervises virtual asset-to-fiat conversion services and stablecoin issuers, while the Capital Markets Authority regulates exchanges, token issuance platforms, initial coin offerings, and tokenisation activities. Both regulators have indicated they are gearing up operationally; the CBK advertised licensing and compliance roles for the new regime as early as April 2026.
Regulations 24 and 25 impose extensive pre-service disclosure obligations. Before onboarding a consumer, a VASP must disclose its licensing status, applicable fees, risks, conflicts of interest, security arrangements, and business continuity measures, and must assess the suitability of its products and services for that consumer where appropriate. The underlying philosophy is straightforward: innovation is permitted, but only where it is matched with accountability to the end user.
Cybersecurity is treated as a standalone regulatory obligation rather than a background operational concern. Regulations 21 and 96–100 require providers to maintain business continuity and incident response plans, implement documented cybersecurity strategies and systems, undertake periodic cybersecurity audits, and report cybersecurity risks to the relevant regulator. Given that custody of client assets is often the single largest point of failure in this sector, this is likely to be one of the more heavily scrutinised areas on initial licence review.
The Regulations go on to establish detailed regimes for initial coin offerings (Regulations 49–60), tokenisation of real-world assets (Regulations 61–65), wallet providers and stablecoin issuers (Regulations 66–84), capital and financial requirements (Regulations 85–95), market conduct (Regulations 108–122), advertising and promotions (Regulations 123–133), and enforcement, including both administrative and criminal sanctions (Regulations 142–143). At 116 pages, the Regulations are dense, and businesses should expect the capital and financial requirements in particular to be a material planning consideration, alongside the governance and disclosure obligations already discussed.
The transition deadline has been flagged for 4th November 2026 by which existing virtual asset businesses are expected to come into compliance with the new regime; as of the gazettement, neither regulator has yet licensed any VASP to operate in or from Kenya. Businesses currently operating in or targeting the Kenyan market, whether locally based or offshore, should undertake a comprehensive review of their governance structures, licensing readiness, technology controls, and compliance frameworks against the new requirements without delay, given the compressed runway between gazettement and the compliance deadline.
The Regulations are a genuine milestone: Kenya now has a structured oversight framework where none existed before. Whether the framework achieves its stated purpose, however, will depend less on the text of the Regulations and more on how consistently the CBK and CMA apply it, and how readily industry participants, particularly offshore platforms with no obvious physical foothold to inspect, can actually be brought within it.
