Kenya’s Crypto Licensing Deadline Arrives as New Regulatory Framework Takes Effect

Last Updated 2 hours ago by Kenya Engineer

Kenya’s cryptocurrency industry has reached an important regulatory milestone, with 4 November 2026 marking the end of the one-year transition period granted to existing virtual asset service providers (VASPs) to comply with the Virtual Asset Service Providers Act, 2025.

The deadline brings into effect a more structured licensing and supervisory framework for businesses involved in cryptocurrency exchanges, digital asset custody, stablecoin issuance, virtual asset payments and other blockchain-based financial services.

The legislation, which commenced on 4 November 2025, established the legal foundation for regulating businesses providing virtual asset services in or from Kenya. Under Section 47, providers already operating when the law came into force were given one year to comply with its requirements.

With that period now ending, businesses covered by the legislation are expected to operate within the licensing framework established by the Act and its implementing regulations.

The development represents an important shift for Kenya’s digital financial services sector, which has experienced growing interest in cryptocurrencies, blockchain-based transactions, digital asset investment and stablecoins. It also introduces new compliance obligations for businesses seeking to participate in a market where regulatory oversight has previously been less clearly defined.

The Regulatory Framework and Its Scope

The Act designates two institutions to oversee the sector: the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA). Their responsibilities are divided according to the nature of the virtual asset services being offered.

The CBK is responsible for licensing virtual asset wallet providers, virtual asset payment processors and stablecoin issuers. The CMA oversees virtual asset exchanges, brokers, investment advisers, asset managers, initial coin offering providers, tokenisation providers and token issuance platforms.

This division is intended to bring different aspects of the digital asset market under the supervision of institutions whose existing mandates cover monetary and payment systems, financial markets and investment activities.

The framework recognises ten licensing categories, covering activities ranging from holding customers’ digital assets in custodial wallets to facilitating transactions, managing investment portfolios and issuing blockchain-based representations of assets.

The legislation also has implications for international businesses. Its application to services provided in or from Kenya means that companies cannot assume they are outside the regulatory framework merely because their platforms or headquarters are located in another country. The nature of their activities and their connection to the Kenyan market are relevant to determining their obligations.

Capital Requirements and the Cost of Entry

The implementing regulations were published as Legal Notice No. 134 of 2026 on 22 July 2026, providing the detailed requirements for licensing and operating under the new framework.

One of the most consequential aspects is the minimum paid-up capital required for different categories of virtual asset businesses. These requirements vary considerably, reflecting the different financial and operational risks associated with each activity.

Under the final regulations, the requirements include:

Source: Fifth Schedule, Virtual Asset Service Providers Regulations, 2026. These are minimum paid-up capital requirements, not the total cost of establishing and operating a licensed business.

The requirements represent a substantial financial commitment, particularly for companies seeking to operate cryptocurrency exchanges, provide custodial services or issue stablecoins.

The final regulations also reduced capital requirements in nine of the ten categories compared with the March 2026 draft regulations. The changes included reducing the proposed minimum capital for exchanges from KSh 150 million to KSh 100 million, and for stablecoin issuers from KSh 500 million to KSh 300 million.

The revisions followed the public consultation process undertaken by the National Treasury, which invited industry stakeholders and members of the public to submit comments on the proposed regulations.

Even with the reductions, the capital thresholds create a significant entry requirement for businesses seeking to establish themselves in Kenya’s regulated digital asset market.

Licensing Goes Beyond Capital Requirements

The new framework places considerable emphasis on governance, financial integrity, cybersecurity and consumer protection.

Applicants must satisfy regulators that they have appropriate organisational structures, competent management, adequate financial resources and systems capable of supporting the services they intend to provide.

The Act requires directors and senior officers to meet fit-and-proper standards. It also establishes requirements relating to registered offices, financial reporting, cybersecurity, insurance, solvency and the protection of customer assets.

For businesses holding digital assets on behalf of customers, one particularly important provision is Section 31, which requires customer holdings to be segregated from the provider’s own assets and protected from claims by the provider’s creditors.

This is significant because customers using custodial platforms depend on the service provider to safeguard the private keys that control their digital assets. Poor custody arrangements, inadequate internal controls or the failure of a platform can expose customers to substantial losses.

The law also gives regulators supervisory powers covering anti-money laundering, countering the financing of terrorism and proliferation financing. These include the ability to conduct inspections, examine records, obtain information and impose enforcement measures.

For the technology sector, cybersecurity is an especially important component. Digital asset platforms operate in an environment where unauthorised access, compromised private keys, software vulnerabilities and attacks on transaction infrastructure can result in direct financial losses.

The regulatory framework consequently places responsibility on providers to establish appropriate security controls, operational safeguards and business continuity arrangements.

The Licensing Register and Questions Around Implementation

One issue emerging as the transition period closes is the public availability of licensing information.

Section 17 of the Act requires each regulatory authority to maintain a register of licences issued under the legislation. The register is expected to contain the name and address of each licensee, the authorised virtual asset services, the date of licensing and the current status of the licence. The law further requires each regulator to publish an updated version on its website.

However, a review of the publicly accessible CBK and CMA information available on 4 November 2026 did not identify a dedicated VASP licensing register or a published list of licensed providers.

This leaves an important question about the industry’s regulatory transition: how can customers, investors and other market participants establish whether a digital asset service provider has obtained the necessary authorisation?

The absence of a publicly accessible register should not, on its own, be interpreted as proof that no applications have been received or that no licences have been granted. The two regulators had previously indicated that licensing would commence once the implementing regulations were issued.

In a joint public notice dated 18 November 2025, CBK and CMA confirmed that neither institution had licensed a VASP under the new law at that time. The regulations subsequently came into force in July 2026.

Whether licensing applications have since been processed and what arrangements are being made for businesses still undergoing assessment remain important questions as the transition period concludes.

Significant Penalties for Operating Without a Licence

The end of the transition period also brings the enforcement provisions into sharper focus.

Section 8 of the Act prohibits a person from carrying on, purporting to carry on, or holding itself out as providing virtual asset services in or from Kenya without the appropriate licence.

Under Section 40(3), a company convicted of an offence under the relevant provisions faces a fine of up to KSh 25 million. An individual may face a fine of up to KSh 10 million, imprisonment for a term of up to five years, or both.

The law also provides for potential liability of directors, partners and senior officers who knowingly authorise, permit or assist in the commission of an offence.

These provisions give the regulators substantial enforcement powers. They also underline the importance of establishing whether a business falls within the activities covered by the legislation and obtaining the appropriate authorisation.

For businesses that have been operating in the sector, the expiry of the transition period is therefore more than an administrative deadline. It marks the end of the statutory window provided to bring their operations into compliance.

Implications for Kenya’s Digital Financial Services Industry

Kenya has developed a substantial digital financial services ecosystem, supported by widespread mobile money adoption, fintech innovation and increasing use of digital platforms for financial transactions.

Virtual assets add another dimension to this ecosystem. Cryptocurrency exchanges, stablecoins and blockchain-based financial products have created new ways of transferring value, accessing digital markets and developing financial services.

Stablecoins, in particular, have attracted attention because they are designed to maintain a relatively stable value against reference assets such as the US dollar. Their potential applications include cross-border payments, digital settlement and access to dollar-denominated value.

Blockchain-based tokenisation also presents opportunities beyond conventional cryptocurrency trading. Real estate, commodities and other assets can potentially be represented through digital tokens, creating new models for ownership, investment and asset transfers.

However, these developments introduce risks involving custody, valuation, market manipulation, fraud, money laundering and technology security.

Kenya’s new framework attempts to address these concerns while providing a legal structure within which legitimate digital asset businesses can operate.

For fintech companies and technology entrepreneurs, the framework introduces a more formal route into the market, but also increases the cost and complexity of compliance. Smaller businesses may need to reconsider their operating models, partnerships and capital requirements.

The requirements could also influence the type of companies willing and able to establish regulated operations in Kenya. Larger financial institutions and well-capitalised technology firms may be better positioned to meet the requirements than early-stage startups.

For consumers, the intended benefits include stronger oversight, clearer accountability and better safeguards for customer assets. However, licensing alone cannot eliminate the risks associated with highly volatile digital assets or guarantee that customers will not incur losses.

What Happens Next?

The immediate priority is the implementation of the licensing framework and the emergence of a transparent regulatory structure.

The publication of licensing registers by CBK and CMA would provide an important reference point for businesses, investors and members of the public seeking to establish the regulatory status of service providers.

The regulators will also need to continue developing their supervisory capacity in an industry characterised by rapidly changing technologies, international platforms and increasingly sophisticated financial products.

Coordination between the two institutions will be particularly important where businesses provide multiple services that fall under different licensing categories.

Kenya’s approach will also be relevant to its wider position in Africa’s digital economy. A clear and consistently implemented regulatory framework could provide greater certainty for responsible businesses considering the country as a base for digital financial services and blockchain innovation.

The end of the transition period on 4 November 2026 is therefore an important point in the implementation of Kenya’s virtual asset regulatory regime. The legislation and regulations are now in place. Attention shifts to licensing, supervision, enforcement and the ability of the regulatory institutions to provide clarity to a rapidly evolving industry.