Unpacking the Gazetted Virtual Asset Service Providers Regulations, 2026

TLA Legislative Watch

Introduction

These Regulations operationalize the Virtual Asset Service Providers Act, 2025 by prescribing the licensing, prudential, governance, consumer protection, cybersecurity, capital adequacy, market conduct and enforcement requirements applicable to Virtual Asset Service Providers operating in or from Kenya.

Legal Framework

The Regulations sit at the base of a deliberate three-tier legal stack:

• 9th January 2025: The Government approved the National Policy on Virtual Assets and VASPs.
• 15th October 2025: Parliament enacted the Virtual Asset Service Providers Act, No. 20 of 2025, which is the primary legislation.
• 22 July 2026: The Cabinet Secretary for the National Treasury gazetted the Virtual Asset Service Providers Regulations, 2026 under Legal Notice No. 134, providing the operational framework for licensing, supervision and compliance.

Licence Categories

Under Regulation 4, the Regulations apply to persons offering virtual asset services in or from Kenya. A person is deemed to be operating “in or from Kenya” where that person:

1. actively solicits or targets local consumers; or
2. derives an economic benefit or income from Kenya, regardless of whether the person has a physical presence in Kenya.

The Regulations create ten distinct licence categories across two regulators: the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA).

Identifying the correct category is the first compliance question every VASP must answer. Operating without a licence is a criminal offence; no grace period is stated for businesses currently in operation.

Licence Category	Regulator	Description
Virtual Asset Exchange	CMA	Platform for trading virtual assets.
Virtual Asset Custodian	CMA	Safekeeping and administration of virtual assets.
Virtual Asset Wallet Provider	CMA	Provides wallets for holding virtual assets.
Virtual Asset Transfer Service Provider	CMA	Transfers virtual assets on behalf of clients.
Initial Virtual Asset Offering (IVAO) Platform	CMA	Platform for raising capital through virtual assets.
Virtual Asset Broker	CMA	Buys and sells virtual assets on behalf of clients.
Virtual Asset Dealer	CMA	Trades virtual assets for its own account.
Stablecoin Issuer	CBK	Issues stablecoins pegged to fiat currency.
Payment Token Service Provider	CBK	Provides payment services using virtual assets.
Other Virtual Asset Service Provider	CMA/CBK	Any additional regulated activity designated under the Act by the relevant regulatory authority.

Licensing Process

An application under Regulation 6 requires a comprehensive package, including:

• Personal details, qualifications and business interests of all directors, senior officers, significant shareholders and beneficial owners;
• A detailed business plan, as prescribed by the Third Schedule;
• Fit and proper assessment forms;
• Proof of source of funds;
• Descriptions of all systems and controls;
• Operational policies covering risk management, AML/CFT/CPF, cybersecurity, IT and complaints management;
• Audited financial statements for the prior three years, or opening financials verified by an auditor for new entities;
• Evidence of paid-up and liquid capital as prescribed by the Fifth Schedule; and
• Proof of payment of the application fee.

The regulator may require an interview and may impose conditions on any licence granted, a discretion whose limits are not clearly defined.

Key Practical Points

Commencement: Under section 47 of the Act, the transitional window closes on 4 November 2026, after which operating without a valid licence is a criminal offence. As per Regulation 6(4), the regulator has up to 30 days to determine a complete application after due diligence on the applicant.

Broad financial stability discretion: An application may be rejected if approval would pose a risk to the stability of the financial system under Regulation 10. Criteria for this assessment are not exhaustively defined.

Commencement of business: A licensee must commence virtual asset business within 12 months of the grant of the licence under Regulation 8.

Anti-licence trading safeguards: A licence may only be assigned or transferred after at least 36 months of operation, subject to regulatory approval and continued compliance under Regulation 13. Unauthorised transfer is void and grounds for revocation.

Renewal: Licences are renewed annually. Applications must be lodged at least two months before expiry.

Capital Requirements

The Fifth Schedule prescribes minimum paid-up capital and liquid capital by licence category. These must be maintained at all times from the point of licensing. Capital raised through shareholder loans, borrowed funds, unpaid commitments or revaluation reserves does not qualify.

Licence Category	Proposed Min. Paid-Up Capital (Ksh)	Passed Min. Paid-Up Capital (Ksh)	Proposed Min. Liquid Capital (Ksh)	Passed Min. Liquid Capital (Ksh)	Regulator
Virtual Asset Wallet Provider	150,000,000	150,000,000	30,000,000 or 100% of current liabilities for at least 30 days, whichever	30,000,000 or 100% of current liabilities for at least 30 days, whichever is	CBK
Virtual Asset Exchange	150,000,000	100,000,000	Liquid net worth equal to 50% of estimated gross operating costs for the next 12 months, or such other amount as the relevant regulatory	20,000,000 or 8% of total liabilities, whichever is higher	CMA
Virtual Asset Payment Processor	50,000,000	10,000,000	10,000,000 or 20% of paid-up capital, whichever higher	100% of current liabilities for at least 30 days	CBK
Virtual Asset Broker	30,000,000	10,000,000	6,000,000 or 8% of total liabilities, whichever higher	2,000,000 or 8% of total liabilities, whichever is higher	CMA
Virtual Investment Adviser	2,500,000	Eliminated	1,000,000 or 8% of total liabilities, whichever higher	Eliminated	CMA
Virtual Asset Manager	30,000,000	20,000,000	6,000,000 or 8% of total liabilities, whichever higher	4,000,000 or 8% of total liabilities, whichever higher	CMA
Virtual Asset Offering Provider — Initial Coin Offering	200,000,000	20,000,000	40,000,000 or 8% of total liabilities, whichever higher	4,000,000 or 8% of total liabilities, whichever is higher	CMA
Virtual Asset Offering Provider — Virtual Asset Tokenization	200,000,000	100,000,000	40,000,000 flat — no percentage alternative	2,000,000 or 8% of total liabilities, whichever is higher	CMA
Virtual Asset Offering Provider — Token Issuance Platform	200,000,000	20,000,000	40,000,000 or 8% of total liabilities, whichever higher	4,000,000 or 8% of total liabilities, whichever is higher	CMA
Virtual Asset Offering Provider — Stablecoin Issuance	500,000,000	300,000,000	100,000,000 or 100% of current liabilities for at least 30 days, whichever higher	60,000,000 or 100% of current liabilities for at least 30 days, whichever is higher	CBK

Stacking of Requirements

Regulation 85(6) replaces cumulative stacking with a highest-category-plus-partial formula. A licensee authorised for more than one permissible activity holds the full paid-up capital of its highest-capital category, plus 50% of the paid-up capital prescribed for each additional activity.

A business combining a wallet provider licence with an exchange licence needs:

Ksh 150,000,000 + 50% × Ksh 100,000,000 = Ksh 200,000,000

in combined paid-up capital — materially less than either the draft regulation’s cumulative approach or a straight re-sum of the new figures.

The same 50% relief is not expressly extended to liquid capital, which Regulation 85(12) simply ties back to the Fifth Schedule amounts.

Capital Relief Across Categories

Paid-up capital minimums fell in nine of ten categories against the draft regulations, several by 80–95% (ICO, Tokenization and Token Issuance Platform providers), and the Investment Adviser minimum was removed entirely.

Wallet Provider held flat at Ksh 150,000,000, and Stablecoin Issuance, cut 40%, remains the single highest threshold at Ksh 300,000,000.

The entry barrier is now concentrated in two categories, custody and stablecoin issuance, rather than spread broadly across the licensing framework as the draft regulations’ thresholds would have done.

What hasn’t changed is the structure itself: each threshold is still a flat bar per category rather than tiered to the size or risk profile of the operator, so a very small and a very large applicant in the same category still face an identical minimum.

Licence Fees

Licence Category	Proposed Application Fee	Application Fee (Ksh)	Proposed Licence Fee	Licence Fee	Proposed Annual Renewal	Annual Renewal
Stablecoin Issuer	100,000	100,000	2,000,000	2,000,000	2,000,000 or 0.15% of gross turnover, whichever higher	Ksh 2M or 0.15% of gross turnover
Wallet Provider	100,000	100,000	500,000	500,000	500,000 or 0.15% of gross turnover, whichever higher	500,000 or 0.15% of gross turnover, whichever higher
Virtual Asset Exchange	100,000	100,000	2,000,000	1,000,000	2% of previous year’s gross income or Ksh 2,000,000, whichever higher	500,000 or 0.5% of previous year’s gross revenue, whichever higher
Virtual Asset Offering Provider — Initial Coin Offering	100,000	100,000	500,000	500,000	Ksh 500K or 0.15% of gross turnover	Ksh 500K or 0.15% of gross turnover
Virtual Asset Tokenization	100,000	100,000	500,000	500,000	500,000 or 0.15% of gross turnover, whichever higher	500,000 or 0.15% of gross turnover, whichever higher
Virtual Asset Token Issuance Platform	100,000	100,000	500,000	500,000	500,000 or 0.15% of gross turnover, whichever higher	500,000 or 0.15% of gross turnover, whichever higher
Virtual Asset Manager	100,000	50,000	500,000	200,000	0.05% of AUM or Ksh 500,000, whichever higher	0.05% of AUM, subject to min Ksh 200,000 and max Ksh 5,000,000
Payment Processor	100,000	100,000	200,000	200,000	200,000 or 0.15% of gross turnover, whichever higher	Restructured into 7 tiered bands by annual transaction value
Broker	100,000	100,000	100,000	200,000	100,000 or 0.15% of gross turnover, whichever higher	Ksh 100K flat
Investment Advisor	20,000	10,000	100,000	50,000	100,000 or 0.15% of gross turnover, whichever higher	50,000 flat

Payment Processor Renewal Bands

Payment Processor renewal bands, based on gross transaction value per annum:

Annual Transaction Value	Renewal Fee
0–1bn	Ksh 20,000
1bn+–10bn	Ksh 100,000
10bn+–50bn	Ksh 500,000
50bn+–100bn	Ksh 1,000,000
100bn+–500bn	Ksh 5,000,000
500bn+–1trn	Ksh 10,000,000
Above 1trn	Ksh 15,000,000

Additional Approval Fees

Additional approval fees apply:

• ICO and virtual asset tokenization approvals: 0.25% of the value of a successful offer, subject to a minimum of Ksh 200,000 and a maximum of Ksh 30,000,000.
• Acquisition, transfer or disposal of shares: 0.25% of transaction value or Ksh 50,000, whichever is higher, for approval of a proposed acquisition, transfer or disposal of shares in a licensee.
• Assignment or transfer of a licence: The full licence fee for the category applies again for approval of assignment or transfer of the licence itself.

Application fees are non-refundable on withdrawal.

Renewal Fee Relief for Exchanges

The exchange renewal fee dropped from a flat 2% of gross income (or Ksh 2,000,000) to 0.5% of the previous year’s gross revenue (or Ksh 500,000) — a quarter of the draft regulation’s rate and floor.

Payment Processor moved off a percentage-of-turnover model entirely onto a seven-band schedule pegged to annual transaction value; whether that’s cheaper or costlier than the draft regulations’ formula now depends on where a given client’s volumes sit, and is worth modelling against actual client data rather than assumed.

AML/CFT/CPF and Market Conduct

This section covers provisions on Anti-Money Laundering (AML), Counter-Proliferation Financing (CPF) and Combating the Financing of Terrorism (CFT).

Every licensee must perform customer due diligence before onboarding a consumer, verifying identity in line with the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA).

The Regulations anchor the anti-money laundering, counter-terrorism financing and counter-proliferation financing regime in that Act rather than restating it, so the graduated measures for higher-risk relationships apply through POCAMLA and its regulations.

The Regulations do not reference the Financial Action Task Force (FATF) Travel Rule. However, transfer-level obligations flow instead from the transaction-information duty, which requires a licensee to record all activity on its platform, retain it for at least seven years, and produce it to a competent authority such as a court of law, a state agency or a relevant regulator, together with metadata such as wallet addresses and chain identifiers.

Virtual asset exchanges and token issuance platforms must run due diligence on every virtual asset before admitting it for trading. The assessment weighs:

• the asset’s regulatory status;
• its supply, liquidity and maturity;
• its risks and those of its issuer;
• the enforceability of consumer rights;
• market capitalisation and volume;
• technical security audits, including smart contract reviews;
• project fundamentals; and
• legal and compliance factors, including AML/CFT/CPF safeguards.

The platform keeps the assessment on record for the life of the listing and monitors each admitted asset on a continuing basis.

Token Listing

Listing itself runs on a notification model. An exchange or token issuance platform lists only assets whose offerings have met the minimum subscription in a white paper approved by the Capital Markets Authority, and notifies the Authority of every new listing or delisting monthly, by the tenth of the following month.

No stablecoin may be listed unless the Central Bank of Kenya has approved it and a licensed issuer has issued it, and the Authority keeps the power to direct a delisting on financial stability or consumer protection grounds.

Token listing practicality: Notification was required for each new listing in the draft regulations, which we flagged as unworkable at scale. The final gazetted Regulations move to a monthly batched notification model, reserving the Authority’s role for approval of the underlying offering and for directed delistings.

Corporate Governance

Governance Arrangements for VASPs

VASPs must establish effective, transparent and adequate governance arrangements to keep services sound.

Arrangements must include a fit and proper board under section 18 of the Act, a documented organisational structure covering ownership, oversight and management, segregation of duties, and internal controls.

The virtual asset business must be ring-fenced in a separate business unit, with its own management structure and separate books of account.

Licensees must maintain adequate operational arrangements, including:

• rules on the rights and liabilities of the licensee and consumer;
• disclosure of the risks a consumer may incur;
• prudent management of consumer funds so they are available at all times for repayment;
• safety, security and operational reliability, including contingency arrangements; and
• separate records and accounts.

Board of Directors

• At least three members, one-third of them independent directors.
• Not more than one-third of the directors may be related to any director.
• The chairperson should not also be appointed chief executive officer.
• The board must set the chairperson’s roles and responsibilities in writing.

An independent director is defined by exclusion: no executive employment with the licensee in the last five years, no association with an adviser, consultant or senior manager, no association with a significant consumer or supplier, no contract of service, no close relation to an adviser or consultant, and none of these relationships with any affiliate.

N/B: The draft regulations’ cap of two virtual asset service provider boards per director, and its bar on any single person holding more than a third of an exchange, stablecoin issuer or wallet provider, do not appear in the gazetted Regulations.

Chief Executive Officer

• Must be fit and proper under section 18 of the Act.
• Must have professional competence in virtual assets or fields relevant to the business.
• Must be domiciled in Kenya.
• Cannot also be the chairperson.

Finance Officers and Internal Auditors

The persons running the finance function and the internal audit function must be members in good standing of the Institute of Certified Public Accountants of Kenya, or of an equivalent international professional body it recognises.

Compliance Officer

• Appointed or designated by the board.
• Monitors compliance and may not hold any function that is the subject of compliance.
• Must have sufficient authority, unfettered access to information, and direct access to the board.
• Takes action to rectify non-compliance and reports to the board any breach it cannot rectify.

Ownership, Shareholding and Control

A “significant shareholder” is a holder of more than ten percent of a company’s share capital.

Acquiring, transferring or disposing of more than ten percent of a licensee requires prior written notification to the regulator.

Register of Interests and Conflicts of Interest

VASPs must keep a register of the holdings, directorships and beneficial interests of directors, senior officers and associated parties in any virtual asset service provider, reviewed at least annually and available to the regulator on request under Regulation 28.

VASPs must identify and document likely conflicts, adopt policies to minimise them, and where a conflict exists either decline to act or disclose and manage it, always putting the consumer’s interests ahead of its own.

They must not misuse consumer information and must use information barriers, staff training and written undertakings to prevent it.

Where the licensee has a material interest or a conflicting relationship in a transaction, it may not advise or exercise discretion unless it has disclosed the interest or taken steps to protect the consumer. It must also not offer or accept inducements that conflict with its duties to consumers.

Stablecoin Issuance

Stablecoin issuance is licensed by the Central Bank of Kenya.

An applicant must file a white paper covering:

• the issuer;
• the stablecoin;
• the offer or admission to trading;
• holder rights and obligations;
• the underlying technology;
• the risks;
• the principal adverse climate and environment-related impacts of the consensus mechanism;
• the method and composition of reserve valuation;
• the stabilisation mechanism;
• a summary of the investment policy; and
• the custody arrangements for the reserve.

The white paper goes to the Central Bank at least ninety days before publication.

An issuer must fully back every stablecoin so that reserve assets at least equal the nominal value of all units in issue at all times.

Reserves are limited to:

• cash assets, including Central Bank deposits and bank deposits;
• government securities with no more than ninety days to maturity;
• repurchase agreements of no more than seven days; and
• other assets the Central Bank approves.

They must be segregated from the issuer’s own assets and from any other stablecoin’s reserve, stress-tested quarterly, and legally insulated from the issuer’s estate so creditors have no recourse to them on insolvency.

Reserve assets must be held by a custodian approved by the Central Bank, unencumbered, and protected from the custodian’s own creditors.

Of the funds received on issuance, at least thirty percent must sit in trust accounts at Kenyan commercial banks segregated for issuance and redemption, with the balance invested in Kenya.

The issuer may not grant interest on a stablecoin, and any benefit tied to how long a holder holds it counts as interest.

A holder may redeem at any time at par value, and the issuer must settle the redemption within two working days by paying the monetary value in fiat. Redemption runs on terms the Central Bank approves.

Capital threshold: The draft regulations set stablecoin issuance capital at Ksh 500 million. The Fifth Schedule to the gazetted Regulations sets it at Ksh 300 million paid-up, with liquid capital of Ksh 60 million or one hundred percent of current liabilities for at least thirty days, whichever is higher.

Offshore stablecoins: Where a stablecoin is issued outside Kenya, the Central Bank of Kenya may exercise its powers under this regulation by directing licensed intermediaries operating in Kenya to restrict access to, or trading of, such stablecoin.

Tokenization of Real-World Assets

There is a dedicated, two-stage framework for tokenizing real-world assets, regulated throughout by the Capital Markets Authority.

A person must first hold a virtual asset tokenization licence, applying to the Authority with the rules of ownership, transferability, compliance and profit distribution, an independent audit of the tokenization systems, and the fee. The Authority decides within thirty days.

Approval of Each Tokenized Asset Offering

Each offering of a tokenized asset then needs separate approval.

The offering application must carry:

• a white paper;
• the issuer’s governance structure;
• monitoring policies;
• the destination of proceeds;
• an independent valuer’s report on the asset’s fair market value;
• disclosure of the technology;
• evidence that the asset can be tokenized and its ownership established;
• a custody agreement identifying who holds title and custody; and
• evidence that the asset is free of encumbrances.

The asset itself must carry clear legal rights and be independently verifiable as to valuation, existence and condition.

Once approved, the issuer creates the tokens on a distributed ledger that is a shared digital record that many computers keep at the same time, codes the rules of ownership and transfer into smart contracts, distributes through a primary offering, and lists the tokens on a licensed token issuance platform to give holders liquidity and an exit.

A smart contract is a computer program that carries out an agreement by itself. Once the agreed conditions are met, it acts automatically, moving the tokens or recording the change, with no middleman needing to step in.

In these Regulations, smart contracts are how the rules of ownership and transfer are built into a tokenized asset.

Enforcement

Enforcement runs on three tracks: administrative sanctions, criminal sanctions, and freezing and seizure.

Administrative Sanctions

On the administrative track, a contravention of the specified provisions exposes an individual to a fine of up to Ksh 3 million and a company to up to Ksh 5 million. The regulator may also suspend or revoke a licence or direct remedial action.

Criminal Sanctions

On the criminal track, the serious offences — insider dealing, market manipulation, false trading and market rigging, fraudulent inducement, use of manipulative devices, false or misleading statements, front-running, churning, cold calling, and false statements in an application — carry a fine of up to Ksh 5 million or imprisonment of up to five years, or both, for an individual, and a fine of up to Ksh 8 million for a company.

Financial penalties are recoverable summarily as a civil debt through a quick, streamlined court process rather than a long case.

Regulatory Intervention

Where a licensee fails to meet its obligations, the regulator may intervene in its management by:

• appointing a statutory manager;
• removing officers who caused the breach;
• restricting new services; and
• prohibiting or terminating agency arrangements.

A statutory manager appointed on suspension or revocation runs for up to twelve months, extendable by a further twelve months with a court’s approval, and may declare a moratorium and take control of consumer assets.

Freezing and seizure of virtual assets follow the procedures of the Proceeds of Crime and Anti-Money Laundering Act and related law.

An authorised officer must preserve the value of seized assets and may convert them to fiat only with the court’s approval, and orders must be framed to protect uninvolved consumers.

How the Final Regulations Answered the Draft Regulations

The public participation window closed and the Regulations were gazetted. In our TLA Alert on the review of the draft regulations, we raised eight issues which were dealt with as follows:

1. The lack of an organizing period for existing operators

In the draft regulations businesses had no window to organize upon being granted a licence, being met with the requirement to commence operations immediately.

The gazetted regulations provide a licensee twelve months from the grant of a licence to commence business under Regulation 8, an improvement from the draft regulations.

2. High Capital Thresholds

The capital floors in the draft regulations were so high they risked shutting out local players which attracted propositions from industry for tiers scaled to size and risk.

No tiers were introduced in the gazetted regulations, but the numbers were cut sharply in the Fifth Schedule.

For instance, Initial Coin Offerings fell from Ksh 200 million to Ksh 20 million, and stablecoin issuance from Ksh 500 million to Ksh 300 million.

The barrier eased, even without formal tiering.

3. The Need for Approval for Any Change in Ownership

The draft regulations required regulator approval for every shareholding change, however small, which was disproportionate.

Adopted. Approval is triggered only above ten percent; below that, notification suffices.

We proposed a ten percent trigger which landed at exactly that in the gazetted regulations. A stake of up to ten percent needs only advance notice and only stakes above ten percent need approval as per Regulation 29, with anti-avoidance rules to stop people splitting holdings to slip under the line.

4. Non-Specificity for Offshore Stablecoins

Any stablecoin offered to the public in Kenya appeared to need a local licence and local reserves, with no way to recognise issuers already licensed in comparable countries in the draft regulations.

The gazetted Regulations, however, create a potential avenue for offshore stablecoins to operate in the market through Regulation 83(2), in which CBK may direct licensed intermediaries to restrict or allow access to, or trading of, any stablecoin issued outside Kenya.

5. The Requirement to Have the Regulator Clearing Every Token Listing

This proposed model under the draft regulations would have made it nearly impossible for exchanges that list thousands of tokens.

We proposed a policy-based approach. This was accommodated in the gazetted regulations such that listings now run on monthly reporting.

Exchanges list assets whose offerings were approved, then notify the regulator of new listings and delistings each month, with the regulator keeping the power to order a delisting where needed.

6. The Use of Vague Market-Abuse Offence Terms

Terms like “manipulative devices” were left undefined in the draft regulations, which invites uneven enforcement.

We highlighted the need for clear definitions and the offences now spell out what they mean in the gazetted regulations.

Use of manipulative devices is defined under Regulation 118, alongside insider dealing, market manipulation, false trading, front-running, churning and cold calling in Regulations 114 to 122.

7. Unsound Creditor Hierarchy on Distress

In the draft regulations small retail customers were lumped in with all other creditors.

However, the gazetted regulations create a situational distinction depending on the type of failure.

If a statutory manager freezes payments, all creditors are still treated equally as per Regulation 48(3).

But if the firm goes into voluntary liquidation, customers must be paid out first, before other creditors line up under insolvency law in line with Regulation 149(5).

Customers got the priority we sought at the liquidation stage.

The Coordination Forum

The Regulations establish the Virtual Assets Services Coordination Forum, in furtherance of section 6(1)(g) of the Act.

Chaired by the National Treasury, it draws representatives from a wide set of agencies named in the Sixth Schedule:

• the Central Bank of Kenya;
• the Capital Markets Authority;
• the Asset Recovery Agency;
• the Ethics and Anti-Corruption Commission;
• the Financial Reporting Centre;
• the Directorate of Criminal Investigations;
• the National Intelligence Service;
• the Nairobi International Financial Centre Authority;
• the National Computer and Cybercrimes Coordination Committee;
• the Office of the Data Protection Commissioner;
• the Office of the Director of Public Prosecutions;
• the Kenya Revenue Authority;
• the Office of the Attorney General;
• the Communications Authority of Kenya;
• the National Counter Terrorism Centre;
• the Sacco Societies Regulatory Authority;
• the Insurance Regulatory Authority;
• the Retirement Benefits Authority; and
• any other agency the Cabinet Secretary designates.

The Forum is the venue for consultation and co-operation, for considering implementation issues raised by the regulators, for timely sharing of risk-based information, for harmonising approaches and resolving cross-sectoral questions, and for supporting risk assessments.

It meets at least once a quarter, may form sub-committees, sets its own procedures, reports annually to the Cabinet Secretary, and is served by a secretariat.

Its members are bound by the confidentiality duty in section 42 of the Act.

Conclusion

The Virtual Asset Service Providers Regulations, 2026 are now law and in operation.

They were gazetted on 22 July 2026 as Legal Notice No. 134 (Kenya Gazette Supplement No. 185, Legislative Supplement No. 103), made by the Cabinet Secretary for the National Treasury under section 49 of the Act.

The window to comply is now open and on its closure, running a virtual asset business without the right licence would be a criminal offence.

What to Do Now

Existing operators. Work out which licence category fits your activity and which regulator holds it, the Central Bank of Kenya or the Capital Markets Authority, then file. With no transition window, every month unlicensed after 4 November 2026 is exposure.

Anyone raising or holding capital. Measure your paid-up and liquid capital against the Fifth Schedule for each licence you need. If you hold more than one licence, the capital requirements stack.

Every board pursuing a VASP licence. Fix your governance. Three directors with one-third independent, a chairperson who is not the chief executive officer, finance and audit officers who belong to ICPAK, and a compliance officer with direct access to the board.

Stablecoin issuers. Line up a Central Bank-approved custodian, full reserves in the permitted assets, at least thirty percent in Kenyan trust accounts, and a redemption process that pays out within two working days.

Tokenization applicants. Have your independent valuation, custody agreement and proof that the asset is free of encumbrances ready before you apply.

All VASPs. Build the anti-money laundering, cybersecurity and consumer-protection systems the rules demand, and take advice early.

---

Contributors

TRUSTED COUNSEL. BOLD FUTURES

Prepared by Thomas Louis Advocates for general information only. This is not legal advice.