Kenya opens licensing for crypto firms as VASP rules take effect

Crypto exchanges, wallet providers and other virtual asset businesses operating in Kenya must now apply for a licence, after the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) confirmed the Virtual Asset Service Providers (VASP) Regulations, 2026 have been gazetted.

In a joint public notice dated 13 November, the two regulators said the regulations were gazetted on 22 July 2026 by the Cabinet Secretary for the National Treasury, in Kenya Gazette Supplement No. 185 under Legal Notice No. 134.

The regulations put the VASP Act, 2025 into operation, giving Kenya its first comprehensive framework for licensing and supervising virtual asset service providers.

“Accordingly, any person(s) providing or intending to provide virtual asset services are required to apply for a licence from the relevant regulatory authority pursuant to the Act,” the regulators said.

The Act names the CBK and the CMA as the regulatory authorities for the sector, with each licensing providers according to the services listed in the First Schedule to the Act. Detailed licensing checklists are available on both regulators’ websites, and each will publish a list of licensed providers.

Operating without a licence now carries significant penalties.

“Companies could attract penalties of up to KES25 million while individuals could be fined up to KES10 million, jailed for up to five years or both for contravening section 8(3) as provided in section 40(3),” said Dmitri Mihhailov, General Partner at Prifinance.

“Note that since 4 November 2026, when the section 47 window ended, it would constitute an offence for a person or company to operate a crypto business in Kenya without the requisite licence.”

Dmitri added that section 8(2) of the Act also makes it an offence to hold oneself out as operating a crypto business in Kenya.

“Watch out if you’re the face or front of a crypto business or platform, even where you’re not handling client funds,” Dmitri said.

“Payment solution providers looking to integrate crypto businesses into their services should check the Kenya Gazette, as all licences granted are required to be published in the Kenya Gazette within 30 days of being granted.”

The VASP Act, 2025 was gazetted on 21 October 2025 and came into force on 4 November 2025. The Treasury then developed the regulations needed to make it work, on the advice of the CBK and the CMA.

The rules arrive at a sensitive moment for the crypto industry. Last month, Binance, one of the most widely used exchanges among Kenyan crypto users, suspended withdrawals for about two days after a US$6.3 billion hack, the largest crypto theft on record.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.