- within Corporate/Commercial Law topic(s)
- with Senior Company Executives, HR and Finance and Tax Executives
- with readers working within the Technology and Law Firm industries
The President of the Republic of Kenya has assented to the Virtual Asset Service Providers Act, 2025 (“VASP Act”), which came into force on 4 November 2025. The VASP Act aims to provide a legal framework for licensing and regulation of the permissible activities of virtual assets (“VA”) service providers (“VASPs”) in Kenya. Kenya has long maintained an active VA and VASP ecosystem facilitating value transfer, investments and remittances. This development occurred in the absence of a legal and regulatory framework for licensing, supervising and regulating VA related activities and VASPs in the country.
Notably, circulars issued by financial sector regulators in 2015 cautioned the public and prohibited regulated financial institutions from dealing with VAs. However, the absence of a regulatory framework for VA/VASPs increased Kenya's vulnerability to Money Laundering, Terrorist Financing and Proliferation Financing (“ML/TF/PF”) risks due to challenges in enforcing ML/CFT measures since VASPs were not designated as reporting institutions under The Proceeds of Crime and Anti-Money Laundering Act, 2010 (“POCAMLA”). Furthermore, the intrinsic characteristics of VAs and VASPs along with their cross-border nature amplified this risk. The VASP Act was therefore enacted to address ML/TF/PF risks, financial and systematic risks, to protect the interests of consumers, and to tap into the digital asset market to unlock investment, innovation and jobs.
The VASP Act designates the Central Bank of Kenya (“CBK”), the Capital Markets Authority (“CMA”) or any other regulator that may be established to license, supervise and regulate VASPs and delineates the specific permissible activities for VASPs under each regulator's remit.
A VA is defined widely under the VASP Act as a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes. However, the VASP Act specifically excludes items such as digital representation of fiat currencies, securities and other financial assets from the definition of a VA. To avoid overregulation, the VASP Act has excluded digital representations of value or rights that operate within a closed ecosystem such as in-game currencies that cannot be exchanged for fiat currency or traded outside the issuer's platform, central-bank issued digital currencies, certain non-fungible tokens not used for payment or investment purposes, among others.
Broadly, the VASP Act prohibits:
- any person from carrying on VA services in or from Kenya, unless that person has been licensed by the relevant authority;
- issuance of initial VA offering, in or from Kenya, or the admission of such assets to trading on a VA trading platform unless the relevant authority approves that issuance; and
- natural persons from offering VA services, promoting or issuing VA offers.
The VA services that are subject to licensing requirements by either the CBK or CMA include: VA wallet provider (custodial as opposed to non-custodial wallet services), VA exchanges, VA payment processors, VA broker, VAs investment advisor, VA manager and VA offering provider services (including initial coin offering, VA tokenisation, token issuance platforms and stablecoin issuance). Only registered companies limited by shares may apply for a licence to offer one or more permissible activities. The VASP Act provides that approved VASPs will be issued with annual licences which may be subject to conditions imposed by the regulators.
According to a joint public notice issued by the CBK and the CMA on 18 November 2025,the general public was advised that the Cabinet Secretary for National Treasury in consultation with the CBK and CMA is still developing regulations to provide further guidance and facilitate implementation of the VASP Act. It is expected that the regulations will provide for the types of licences that will be issued, the prescribed forms and the applicable fees in relation to licence applications. Until such time as regulations are passed, licensing and regulation of VASPs and VA activities is in limbo.
Licensed VASPs will be subject to obligations such as:
- maintenance of a physical office in Kenya;
- management of a VASP will be by at least three natural directors, approved by the regulators;
- adhering to capital, solvency and insurance requirements (yet to be prescribed);
- conducting business with integrity;
- implementation of policies and procedures that mitigate and deal with conflicts of interest;
- compliance with AML/CFT/CPF provisions; and
- operation of a local bank account.
The potential benefits of establishing a regulatory framework for VASPs include strengthened consumer protection, improved AML/CFT/CPF measures, regulatory consistency, increased transparency, accountability and governance of VASPs, and as well as fostering investor and consumer confidence in Kenya's VASP sector.
Regulation of VASPs also poses risks such as an increase in the operational costs for VASPs due to compliance requirements such as maintenance of a registered office, adherence to capital, solvency and insurance requirements, annual licence renewals, among others. The interaction of VAs with the traditional financial sector may pose contagion risk due to price fluctuations and volatility in the VA market. Thirdly, the hefty fines imposed under the Act, though likely to increase consumer confidence in the ecosystem, may negatively affect investor confidence.
Natural persons are prohibited from conducting VA services likely due to concerns such as financial stability, ML/FT/PF risks, and operation and security risks. Whether this protection outweighs the ability of natural persons (such as miners) from participating in VA services, is a moot point.
From a FinTech mergers and acquisitions (M&A) perspective, the following key changes require notification to and approval by the relevant regulatory authority:
- any change in shareholding of the VASP;
- issuance of new shares;
- any material changes to the business of a VASP, which has been
defined to include:
- changes to the VASPs business plan;
- a merger with or acquisition of another legal person by the VASP;
- sale of a subsidiary or acquisition of a controlling interest in another entity.
Whether these approvals would significantly affect timelines for closing transactions will depend on the approval timelines, fee and processes to be published in the regulations.
Kenya now joins jurisdictions such as the United Kingdom, South Africa, France, Namibia, and Mauritius, among others, in the regulation of VASPs. From a transition perspective, Section 47 of the VASP Act requires that all VASPs currently operating in Kenya to comply with the provisions of the Act within one year of the commencement of the Act, being 04 November 2026.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
