Kenya is moving to bring its growing virtual asset industry into the formal financial system, following the gazettement of the Virtual Asset Service Providers Regulations, 2026, by the National Treasury.
The regulations, published on July 22, 2026, as Legal Notice No. 134 in Kenya Gazette Supplement No. 185, provide the operational rules for implementing the Virtual Asset Service Providers Act, 2025.
This comes as digital asset transfers and blockchain-based financial products have attracted considerable interest, often operating without a dedicated licensing framework.
Under the new arrangement, the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) will jointly oversee the industry, with each regulator responsible for specific categories of virtual asset services.
In a joint public notice dated November 13, the two institutions confirmed that the regulations had been gazetted, bringing the licensing framework into operation.
The regulators stated that anyone “providing or intending to provide virtual asset services” must apply for a licence from the relevant authority.
The notice also confirmed that the respective regulators will publish lists of licensed providers, giving consumers and businesses a means of identifying authorised operators.
A divided regulatory market
The framework introduces ten categories of licensable virtual asset activities, separating payment-related services from investment and trading operations.
The CBK will oversee virtual asset wallet providers, payment processors and stablecoin issuers. The CMA, on the other hand, will regulate virtual asset exchanges, brokers, investment advisers, asset managers, initial coin offering providers, tokenisation businesses and token issuance platforms.
The distinction is important because companies offering more than one regulated service may need to satisfy requirements covering different activities and regulatory responsibilities.
For instance, a business operating a cryptocurrency exchange while also providing custodial wallet services could fall under both regulatory jurisdictions.
The regulations also extend beyond companies physically established in Kenya. Foreign platforms that actively target Kenyan consumers or generate income from the country can fall within the regulatory perimeter even without a local physical presence.
However, the framework does not cover every digital token. Certain closed-ecosystem digital representations, central bank-issued fiat currencies, and non-fungible tokens (NFTs) that are not used for payment, investment or financial purposes are excluded under the parent Act. Virtual service tokens are also outside the licensing requirement.
This means the regulator’s focus is on the economic function of a digital asset and the service being provided, rather than simply whether a product uses blockchain technology.
Licensing will raise the cost of doing business
For companies already operating in the sector, the new framework introduces a substantial compliance exercise.
Applicants must provide business plans, proof of funding sources, details of directors, senior officers and beneficial owners, audited financial statements and evidence of adequate paid-up and liquid capital.
They must also demonstrate that they have systems covering anti-money laundering, counter-terrorism financing, cybersecurity, data protection, consumer protection, risk management and complaints handling.
The financial requirements vary according to the nature and risk of the business. Operators must also maintain appropriate insurance, accounting systems and technology infrastructure.
A complete licence application must be determined by the relevant regulator within 30 days after all required documentation has been submitted and due diligence completed.
These requirements could make it more difficult for smaller operators to compete, particularly businesses that have relied on relatively lean operating structures.
For established financial technology companies and international digital asset businesses, however, a clearly defined licensing framework could offer a more predictable environment for investment, partnerships and expansion.
The regulations also require licensed businesses to maintain proper corporate governance structures, appoint compliance officers and establish business continuity and incident response plans.
Cybersecurity is another major area of focus. A provider that discovers a cybersecurity incident must notify its regulator within 24 hours and submit a detailed report within five working days. Material incidents, loss of keys and unauthorised transactions also attract a 24-hour reporting requirement.
The intention is to make operational resilience part of the cost of running a virtual asset business rather than treating security failures as isolated technical problems.
Fines, suspension and possible imprisonment
The new framework gives regulators enforcement powers that go beyond issuing warnings to non-compliant businesses.
Under Regulation 142, specified breaches attract administrative fines of up to KSh3 million for individuals and KSh5 million for companies.
Regulators can also suspend or revoke licences, approvals and authorisations or direct businesses to take corrective action.
More serious offences, including insider trading, market manipulation, fraudulent inducement of transactions, front-running and failure to comply with lawful freezing or seizure orders, fall under Regulation 143.
On conviction, an individual can face a fine of up to KSh5 million, imprisonment for up to five years, or both. A company can face a fine of up to KSh8 million.
Separately, the parent Act imposes heavier penalties for operating a virtual asset business without the required licence. An individual convicted of the offence faces a fine of up to KSh10 million or imprisonment for up to five years, or both, while a company faces a fine of up to KSh25 million.
Directors and senior officers who knowingly authorise, permit or assist offences committed by a licensed provider can also face personal liability.
The distinction between administrative sanctions under the Regulations and criminal penalties under the Regulations and the parent Act is important. Not every compliance failure carries the same punishment.
What changes for ordinary Kenyans?
The regulations require licensed providers to establish safeguards for customer assets, including arrangements that separate consumer holdings from the company’s own assets.
A provider cannot freely use customer virtual assets for its own account or for another person’s benefit. It must maintain accurate records of ownership and transactions, reconcile customer holdings and ensure that the assets are not available to satisfy claims by the company’s creditors.
Customer funds must also be maintained in separate accounts from the provider’s own money.
Consumers must receive clear information about the services being offered, applicable charges, investment risks and contractual obligations.
The regulations prohibit providers from promising investment returns. Before recommending or executing transactions, they must take reasonable steps to ensure that customers understand the risks involved.
Complaint handling is another important requirement. Providers must establish procedures for investigating and resolving disputes, maintain complaint records and inform customers of the progress of their complaints within 21 days.
Where a complaint is upheld, the provider must communicate the outcome, offer appropriate restitution and address weaknesses in its internal systems that contributed to the problem.
The records of complaints and actions taken must be retained for at least seven years.
For Kenyans who have previously dealt with digital asset platforms without clear local accountability, these provisions could offer a more structured route for seeking redress.
However, regulation should not be confused with a guarantee against investment losses. Virtual assets remain exposed to price volatility, liquidity problems and technological risks. A licensed platform does not mean that every asset it offers is safe or profitable.
Kenya’s bigger financial ambition
Rather than leaving virtual assets outside the formal regulatory system, the government is attempting to establish rules under which the industry can operate while addressing risks associated with financial crime, consumer losses, market manipulation and financial stability.
The framework also creates room for activities beyond cryptocurrency trading.
Its provisions on tokenisation of real-world assets could support the development of digital investment products linked to assets such as property and commodities, subject to the required approvals and disclosures.
The stablecoin provisions are equally significant.
Issuers must maintain reserve assets, provide for redemption at par value and submit regular information to the CBK. These requirements could create a more accountable environment for digital tokens designed to maintain a stable value against traditional currencies.
For investors, financial institutions and technology companies, this opens a new regulatory market with opportunities in payments, custody, digital investment management and blockchain-based financial infrastructure.
The government has also established a Virtual Assets Services Coordination Forum to improve cooperation and information sharing among regulatory and enforcement agencies.