AML and Travel Rule Compliance for Kenya’s Newly Licensed VASPs

Kenya’s Virtual Asset Service Providers Act, 2025 is regularly described as bringing crypto businesses “under FATF’s Travel Rule.” That is not quite what the Act and its 2026 Regulations actually do. Anyone building AML/CFT compliance for a Kenyan VASP licence needs to work from what the framework actually requires, not from the shorthand a headline uses, and the gap between the two is itself worth understanding before you build a compliance programme around the wrong assumption.

How VASPs are actually brought into Kenya’s AML/CFT regime

The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025, with the Central Bank of Kenya and the Capital Markets Authority as joint licensing and supervisory authorities: CBK for virtual-asset-to-fiat conversion, custodial wallet services and stablecoin issuance, and CMA for exchanges, trading platforms and tokenisation activity. CBK’s own public notice on the Act confirms it “outlines obligations of VASPs in the prevention of Money Laundering, Terrorism Financing, and Proliferation Financing,” but the mechanism is not a standalone VASP-specific AML code. The Virtual Asset Service Providers Regulations, 2026, gazetted mid-2026, anchor VASP AML/CFT compliance in Kenya’s existing Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) framework rather than restating customer due diligence and reporting duties from scratch. In practice, this means a licensed VASP inherits the same risk-based CDD, record-keeping and suspicious-transaction-reporting architecture that already applies to banks and other reporting institutions, layered onto virtual-asset-specific licensing conditions.

What the Travel Rule label gets wrong

The FATF Travel Rule, formally Recommendation 16, requires originator and beneficiary information to travel with a transfer above a set threshold so that both ends of a transaction chain can identify who is sending and receiving funds. On the material available, neither the VASP Act 2025 nor the 2026 Regulations contain an explicit Travel Rule clause: there is no stated monetary threshold, and no prescribed list of originator or beneficiary data fields that must accompany a virtual asset transfer. What the Regulations do impose is a general record-keeping duty: VASPs must log platform activity, including wallet addresses and chain identifiers, and retain those records for at least seven years, producible to a competent authority on request. That is a real and substantial obligation, but it is not the same thing as an interoperable Travel Rule messaging standard, and a compliance programme built on the assumption that one already exists in Kenyan law will be building around a rule that has not yet been enacted. Businesses operating across multiple jurisdictions should still consider voluntary Travel Rule alignment for the international leg of their AML programme, since Kenya’s absence of a domestic rule does not exempt cross-border transfers from a counterparty jurisdiction’s own Travel Rule obligations.

The POCAMLA connection and Kenya’s FATF status

Kenya has remained on the Financial Action Task Force’s list of jurisdictions under increased monitoring (the “grey list”) since February 2024. Some industry commentary frames the VASP Act as a step in Kenya’s exit strategy from that list. That framing should be treated with some caution: FATF’s own published follow-up items for Kenya, most recently updated in February 2026, concern traditional risk-based supervision, designated non-financial businesses and professions, beneficial ownership transparency, the Financial Intelligence Unit’s capacity, money-laundering and terrorism-financing investigations, and non-profit-organisation oversight. None of FATF’s own stated action items for Kenya specifically references virtual assets or VASP supervision. The VASP Act may well support Kenya’s broader AML credibility, but there is no confirmed FATF assessment timeline tied specifically to virtual-asset regulation, and a client should not be told that VASP licensing alone accelerates grey-list removal.

What we could not verify, and what that means for a compliance build

Several specifics that a compliance team will eventually need are not yet publicly settled. We found no published CBK or CMA register showing how many VASPs have been licensed as of this year; public commentary as recently as mid-2026 described licensing as only newly able to begin once the Regulations were gazetted. We also could not confirm which body carries day-to-day AML supervisory responsibility for VASPs specifically, since neither the Act nor the Regulations summaries we reviewed clearly designate the Financial Reporting Centre in that role alongside CBK and CMA’s licensing functions. Separately, the Finance Bill 2026 has reportedly proposed a wallet and transaction information-return regime for VASPs tied to the OECD’s Crypto-Asset Reporting Framework; that is a tax-transparency measure administered by the Kenya Revenue Authority, not an AML Travel Rule, and the two should not be conflated when explaining obligations to a client. Anyone drafting a VASP compliance manual right now should build it around the confirmed POCAMLA-anchored CDD and seven-year record-retention duties, treat Travel Rule alignment as a voluntary best practice rather than a domestic legal requirement, and revisit the analysis once CBK or CMA publishes clearer supervisory guidance or a licensing register.