Draft Virtual Asset Service Providers Regulations, 2026
Table of Contents
Introduction
The National Treasury has published the Draft Virtual Asset Service Providers Regulations, 2026 (“the Regulations”), operationalizing the Virtual Asset Service Providers Act, No. 20 of 2025 (“the Act”).
This review is written for founders, investors, legal practitioners, and all stakeholders in Kenya’s virtual asset sector. The public participation window is open. Submissions should be directed to the National Treasury at treasury.go.ke.
I. The Legal Framework
The Regulations sit at the base of a deliberate three-tier legal stack:
2025: The Government approved the National Policy on Virtual Assets and VASPs.
2025: Parliament enacted the Virtual Asset Service Providers Act, No. 20 of 2025 which is the primary legislation.
2026: The National Treasury published these draft Regulations as secondary legislation operationalizing the Act.
The Regulations provide the operational substance such as fees, capital thresholds, licensing procedures, and penalties.
II. License Categories
The Regulations create ten distinct licence categories across two regulators, that is, the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA). Identifying the correct category is the first compliance question every VASP must answer. Operating without a licence is a criminal offence; no grace period is stated for businesses currently in operation.
| Licence Category | Regulator |
| Virtual Asset Wallet Provider | CBK |
| Virtual Asset Payment Processor | CBK |
| Virtual Asset Offering Provider — Stablecoin Issuance | CBK |
| Virtual Asset Exchange | CMA |
| Virtual Asset Broker | CMA |
| Virtual Asset Investment Advisor | CMA |
| Virtual Asset Manager | CMA |
| Virtual Asset Offering Provider — ICO | CMA |
| Virtual Asset Offering Provider — Tokenization | CMA |
| Virtual Asset Offering Provider — Token Issuance Platform | CMA |
III. The Licensing Process
An application under Regulation 5 requires a comprehensive package: personal details, qualifications, and business interests of all directors, senior officers, significant shareholders, and beneficial owners; a detailed business plan (per the Third Schedule); fit and proper assessment forms; proof of source of funds; descriptions of all systems and controls; operational policies covering risk management, AML/CFT/CPF, cybersecurity, IT, and complaints management; audited financial statements for the prior three years (or opening financials verified by an auditor for new entities); evidence of paid-up and liquid capital per the Fifth Schedule; and proof of payment of the application fee.
The regulator may require an interview and may impose conditions on any licence granted, a discretion whose limits are not clearly defined.
Barrier for Startups
The three-year audited financials requirement creates a structural barrier for new entrants. The practical standard for demonstrating financial soundness without operating history is unclear. We recommend formal Treasury guidance on what new entrants must demonstrate in lieu of historical financials.
Vague Rejection Criteria
Regulation 9 permits rejection for a “history of regulatory breaches” without defining what that history means; a single prior breach, a breach in a different sector, or a breach by a related party. This ambiguity invites inconsistent application and regulatory uncertainty. We recommend tighter criteria, defined timelines, and a clear appeals mechanism.
Commencement and Transfer
Licensees must commence operations immediately upon licensing. An extension is available but cannot exceed twelve months which poses a constraint with real implications for international players requiring significant infrastructure build-out. Transfer of a licence requires the licensee to have held it for a minimum of thirty-six months, and the transfer must be demonstrably necessary in the interest of the business, its consumers, or financial stability. This effectively prevents licence trading in the early years of the framework.
IV. Capital Requirements
The Fifth Schedule prescribes minimum paid-up capital and liquid capital by licence category. These must be maintained at all times from the point of licensing. Capital raised through shareholder loans, borrowed funds, unpaid commitments, or revaluation reserves does not qualify, only cash or other consideration capable of objective valuation and immediate realization.
| No. | Licence Category | Min. Paid-Up Capital (Ksh) | Min. Liquid Capital (Ksh) | Regulator |
| 1 | Virtual Asset Wallet Provider | 150,000,000 | 30,000,000 or 100% of current liabilities for at least 30 days, whichever is higher | CBK |
| 2 | Virtual Asset Exchange | 150,000,000 | 50% of estimated gross operating costs for the next 12 months, or such other amount as prescribed by the relevant regulatory authority | CMA |
| 3 | Virtual Asset Payment Processor | 50,000,000 | 10,000,000 or 20% of paid-up capital, whichever is higher | CBK |
| 4 | Virtual Asset Broker | 30,000,000 | 6,000,000 or 8% of total liabilities, whichever is higher | CMA |
| 5 | Virtual Asset Investment Adviser | 2,500,000 | 1,000,000 or 8% of total liabilities, whichever is higher | CMA |
| 6 | Virtual Asset Manager | 30,000,000 | 6,000,000 or 8% of total liabilities, whichever is higher | CMA |
| 7 | Virtual Asset Offering Provider — Initial Coin Offering | 200,000,000 | 40,000,000 or 8% of total liabilities, whichever is higher | CMA |
| 8 | Virtual Asset Offering Provider — Virtual Asset Tokenization | 200,000,000 | 40,000,000 | CMA |
| 9 | Virtual Asset Offering Provider — Token Issuance Platform | 200,000,000 | 40,000,000 or 8% of total liabilities, whichever is higher | CMA |
| 10 | Virtual Asset Offering Provider — Stablecoin Issuance | 500,000,000 | 100,000,000 or 100% of current liabilities for at least 30 days, whichever is higher | CBK |
Stacking of Requirements
Where a licensee holds more than one licence, capital requirements apply separately for each. A business holding both a wallet provider licence and an exchange licence must maintain a combined minimum paid-up capital of Ksh 300,000,000. This has material implications for multi-product businesses.
Exclusionary Thresholds
The Ksh 500M stablecoin requirement and the Ksh 200M threshold for ICO, tokenization, and token issuance platforms will entrench concentration by large international players rather than create space for local competition, a risk well-evidenced by Nigeria’s experience. We advocate for a tiered capital framework within each licence category, calibrated to the size and risk profile of the operator, as implemented in Singapore and South Africa.
V. Licence Fees
| Licence Category | Application Fee | Licence Fee | Annual Renewal |
| Stablecoin Issuer | Ksh 100,000 | Ksh 2,000,000 | Ksh 2M or 0.15% of gross turnover |
| Virtual Asset Exchange | Ksh 100,000 | Ksh 2,000,000 | 2% of gross income or Ksh 2M |
| Wallet Provider / ICO / Tokenization / Token Platform | Ksh 100,000 | Ksh 500,000 | Ksh 500K or 0.15% of gross turnover |
| Virtual Asset Manager | Ksh 100,000 | Ksh 500,000 | 0.05% of AUM or Ksh 500K |
| Payment Processor | Ksh 100,000 | Ksh 200,000 | Ksh 200K or 0.15% of gross turnover |
| Broker / Investment Advisor | Ksh 100,000 | Ksh 100,000 | Ksh 100K or 0.15% of gross turnover |
Additional transaction and approval fees apply: a 0.05% transaction fee on exchange and token issuance platform transactions (payable by each counterparty); 0.5% on the value of a successful virtual asset offering; Ksh 200,000 for stablecoin issuance approval; and 0.25% on share acquisitions and licence transfers. Application fees are non-refundable on withdrawal.
Exchange Renewal Fee
The 2% of gross income renewal fee for exchanges is notably high relative to equivalent fees in other Kenyan regulated financial sectors. For high-volume exchanges already paying a 0.05% per-transaction fee, this creates a material compounding compliance cost. This is a priority area for industry comment during public participation.
VI. Corporate Governance
All licensees must maintain a board of at least three directors, of whom at least one-third must be independent. No more than one-third of directors may be related to one another. The chairperson cannot serve concurrently as CEO. Both the finance officer and internal auditor must be ICPAK members.
Each licensee must appoint a board-appointed Compliance Officer with unfettered access to information, direct board access, and authority to rectify non-compliance. The Compliance Officer must report material breaches to the board and submit an annual governance report. Directors are limited to serving on no more than two VASP boards simultaneously.
For exchanges, stablecoin issuers, and wallet providers specifically, no single person may hold more than 33.3% of issued share capital or voting rights, or appoint more than one-third of the board unless that person is a corporate entity whose ultimate beneficial owners each hold less than 33.3% of that entity.
Director Board Limits
The two-board limit has an outsized impact on the startup ecosystem, where founders routinely sit on multiple portfolio company boards. We recommend differentiating the limit as applied to executive versus non-executive roles.
Shareholding Threshold
Regulatory approval is required for any shareholding change with no minimum quantitative threshold — meaning even a minor transfer triggers a full approval process. We recommend introducing a threshold (our submission proposes 10% of issued capital) before approval is required, consistent with competition law norms.
VII. AML/CFT/CPF and Market Conduct
All licensees must implement full customer due diligence prior to onboarding, in accordance with the Proceeds of Crime and Anti-Money Laundering Act. Enhanced due diligence applies to high-risk clients. Suspicious transaction reports must be filed with the Financial Reporting Centre. The FATF Travel Rule that requires VASPs to collect, verify, and transmit originator and beneficiary information on transfers above prescribed thresholds applies.
Exchanges and token issuance platforms must conduct due diligence on all virtual assets before admission to trading. Where a virtual asset is based on a smart contract, an independent audit of that contract is mandatory before listing. Listed assets must be continuously monitored for continued viability.
Token Listing Practicality
Requiring regulatory notification for every new token listing is not scalable for major exchanges listing thousands of tokens — including meme coins and decentralized assets with no identifiable issuer. We recommend a policy-based approach: exchanges submit a listing policy to the regulator for approval and subsequently list within that approved framework, without case-by-case sign-off. This reflects international best practice.
VIII. Stablecoin Issuance
The Regulations dedicate an entire Part to stablecoin issuance — one of the most detailed and consequential sections. Applicants must include investment policies for reserve assets, redemption policies, and a white paper covering the issuer, the stablecoin, the offer, holder rights and obligations, underlying technology, risks, environmental impact of the consensus mechanism, and reserve asset composition. The white paper must carry an explicit warning that the stablecoin is not covered by investor compensation schemes or deposit insurance.
The Interest Prohibition
Regulation 69 prohibits stablecoin issuers and any licensee providing related services from granting interest on stablecoins. The prohibition extends to any remuneration or benefit tied to holding duration, including net compensation, discounts, or anything with an equivalent effect to interest. This is a deliberate policy choice to prevent stablecoins from encroaching on deposit-taking functions reserved to licensed banks. The rationale is sound, but the breadth of the prohibition that extends to third-party remuneration “directly associated” with stablecoin holdings, raises questions about its reach into DeFi protocols and loyalty programmes. Industry should seek clarification during public participation.
Reserve Asset Requirements
Issuers must fully back all stablecoins with reserve assets equal at all times to the nominal value of outstanding stablecoins. Acceptable assets are limited to: cash (including central bank reserve deposits and bank deposits); government securities with residual maturity not exceeding ninety days; and repurchase agreements with maturity not exceeding seven days backed by cash or bank deposits. At least 30% of funds received must be held in segregated accounts at Kenyan commercial banks. The balance must be invested in high-quality liquid assets in Kenya. For fiat-referenced stablecoins, reserves must be denominated in the referenced currency.
Reserves must be segregated from operating assets and from the reserves of any other stablecoin. Where an issuer issues multiple stablecoins, separate reserve pools are required for each. Reserve assets must be held by a CBK-approved custodian and may not be pledged, encumbered, or used as financial collateral. All profits, losses, and risks from reserve investment are borne by the issuer.
Redemption and Liability
Holders have an unconditional right to redeem at par value at any time, at no fee. Where stablecoins were sold for Kenya Shillings, the issuer must always provide KES redemption. Where a white paper contains information that is not complete, fair, or clear, or is misleading the issuer and its directors, significant shareholders, senior officers, and external auditors are jointly liable for any resulting holder loss. Contractual exclusions of this liability have no legal effect.
Ksh 500M Capital Threshold
The capital requirement for stablecoin issuers is the highest in the entire framework and effectively limits this market to banks and large international players. A Kenyan startup building a local payment stablecoin cannot realistically mobilize that capital. We recommend a tiered licensing structure within the stablecoin category, distinguishing large-scale issuers from limited-purpose payment stablecoins.
Global Stablecoins
The Regulations appear to require local licensing and local reserve segregation for any stablecoin offered to the public in Kenya. It is unclear whether this is enforceable against offshore issuers of USDT, USDC, and equivalent instruments already in active use by Kenyan consumers. A passporting or reciprocity mechanism for issuers licensed in equivalent jurisdictions requires explicit Treasury clarification.
IX. Tokenization of Real-World Assets
Part VII creates a dedicated framework for the tokenization of real-world assets — the creation of digital tokens on a distributed ledger representing fractional ownership or rights to a physical asset. A CMA licence is required. Applications must include evidence that the asset can be tokenized and that ownership can be established; a custodian agreement for title and physical custody; an independent valuation report; and evidence the asset is clear of encumbrances.
White papers for tokenized offerings must fully disclose the rights the token grants, custody arrangements, risk assessments (credit, market, counterparty, liquidity), valuation methodology, token creation and destruction policies, transferability restrictions, and the interoperability of the distributed ledger used. Tokens must be listed on a licensed token issuance platform to provide investor exit options.
This is a forward-looking framework. Properly implemented, it opens significant possibilities — from fractional ownership of real estate to tokenized securities on the Nairobi Securities Exchange — and could position Kenya as a regional leader in asset tokenization.
X. Enforcement — Penalties, Intervention, and Seizure
Penalties
Criminal and administrative penalties under the Regulations range from Ksh 3,000,000 to Ksh 20,000,000, with custodial sentences of up to five years applying to the most serious offences, including insider trading, market manipulation, false statements in licence applications, and failure to comply with freezing or seizure orders.
The Ksh 20M penalty for false statements in a licence application by a company is high relative to comparable regulated sectors. Of greater concern is the potential for multiple statements in a single application to be treated as separate offences, substantially multiplying financial exposure. We recommend clarity on whether penalties apply per application or per offending statement, with a proportionality principle to prevent punitive stacking.
Regulatory Intervention and Statutory Management
Where a licensee fails to meet its obligations to customers, other licensees, or the regulator, the regulator may intervene: appointing a statutory manager, removing officers, restricting new services, and terminating agency arrangements. A statutory manager is appointed by Gazette notice for up to twelve months (extendable by court order for a further twelve). Their powers include taking physical possession of all assets, selling assets, assuming liabilities, continuing operations, and litigating in the licensee’s name. Statutory management costs are recoverable from the licensee’s assets in priority to all other claims.
Importantly, any moratorium applies equally to all creditor classes unlike banking insolvency law, which typically provides preferential treatment for depositors. We recommend the Treasury consider whether some degree of creditor protection hierarchy, particularly for small retail consumers, should be introduced into the moratorium framework.
Freezing and Seizure Orders
Aligned with the Proceeds of Crime and Anti-Money Laundering Act, the Regulations provide for freezing and seizure of virtual assets. Where a seizure order is made, the competent authority may convert volatile virtual assets to fiat currency to preserve value. Licensees must comply immediately and maintain detailed chain-of-custody records. The power to convert seized assets to fiat is novel and operationally uncertain questions remain about who bears price movement risk, how conversion will be executed without moving the market, and what recourse an accused party has if assets are converted unfavourably before acquittal. Detailed operational guidelines are needed before the Regulations take effect.
XI. Key Recommendations for Public Participation
The following positions form the basis of our formal public participation submission. We encourage all industry stakeholders to adopt and amplify them.
- No Transition Period for Existing Operators: On gazettement, every unlicensed VASP is technically in breach. We recommend a minimum twelve-month transition period from gazettement during which existing operators may continue to operate while licence applications are processed.
- Introduce Tiered Capital Requirements: Current thresholds , particularly for stablecoin issuers, ICO providers, and tokenization platforms, exclude smaller local players. A tiered framework within each licence category, calibrated to operator size and risk profile, would prevent the market concentration seen in other African markets where high capital barriers drove consolidation.
- Set a Threshold for Share Acquisition Approvals: Requiring regulator approval for any shareholding change regardless of size is operationally disproportionate and will deter legitimate investment. We recommend a 10% of issued capital threshold before the approval requirement is triggered.
- Clarify the Scope of the Interest Prohibition: The prohibition as drafted may unintentionally capture certain DeFi protocols, loyalty programmes, and third-party reward structures. Clearer definitional boundaries are essential.
- Clarify the Treatment of Global Stablecoins: A passporting or reciprocity framework for issuers licensed in equivalent jurisdictions should be introduced, to avoid regulatory gaps and disproportionate barriers to cross-border digital currency use.
- Introduce a Proportionate Token Listing Framework: Exchanges should be empowered to develop listing policies for regulatory approval, within which they may list tokens without individual sign-off consistent with international practice and operational realities.
- Define Ambiguous Market Conduct Terms: Offences including the use of “manipulative devices” require clearer definitional boundaries to ensure consistent and fair enforcement and to protect innocent market participants from enforcement risk.
- Address Creditor Hierarchy in Moratorium Provisions: The equal treatment of all creditor classes under a statutory manager’s moratorium is a departure from banking insolvency norms. Small retail consumers deserve at least consideration of preferential treatment, consistent with the consumer protection objectives of the Act.
XII. The Coordination Committee
Regulation 142 establishes a Relevant Regulatory Authorities Coordination Committee, chaired by the National Treasury. Membership includes the CBK, CMA, Asset Recovery Agency, Financial Reporting Centre, Directorate of Criminal Investigation, National Intelligence Service, Nairobi International Financial Centre Authority, National Computer and Cybercrimes Coordination Committee, Office of the Attorney General, Communications Authority, and the National Counter Terrorism Centre. The Committee coordinates supervisory activities, facilitates information sharing, harmonises regulatory approaches, supports joint inspections, and issues joint advisories on cross-sectoral matters. It meets at least quarterly. All members are subject to confidentiality obligations under section 42 of the Act.
Conclusion
The VASP Regulations, 2026, are a serious and substantive piece of regulatory work. They reflect careful study of international frameworks and a genuine commitment to bringing Kenya’s virtual asset sector within the formal economy. Much of what they contain is appropriate, well-structured, and necessary.
The capital thresholds, fee structures, absence of a transition period, breadth of the interest prohibition, treatment of offshore stablecoins, and token listing framework are all issues where targeted, evidence-based submissions can and should shape the final Regulations.
The public participation window is the only opportunity to shape these rules before they are set in stone. We urge every founder, investor, legal practitioner, and ecosystem participant to engage. The full draft Regulations are available at treasury.go.ke.