Cryptocurrency and Digital Asset Regulation in Kenya: CBK, CMA and the Legal Framework

Cryptocurrency regulation in Kenya changed fundamentally in November 2025. For years the position was a regulatory gap, filled only by cautionary notices from the Central Bank of Kenya (CBK). Kenya now has a dedicated licensing statute, the Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025), supported by the Virtual Asset Service Providers Regulations, 2026. This guide explains who regulates virtual asset businesses, who can apply for a licence, and what still sits outside the new regime.

Cryptocurrency regulation in Kenya before the VASP Act

Before the Act, the CBK repeatedly warned the public that virtual currencies are not legal tender in Kenya and that dealing in them carried risk without CBK protection. Those warnings did not criminalise holding or trading crypto assets, but they left exchanges, wallet providers and token issuers without a clear licensing route. Businesses relied on general law: the Capital Markets Act where a token looked like a security, the National Payment System Act where a service looked like a payment service, and anti-money laundering obligations for those who fell within the reporting regime. That patchwork produced real uncertainty for banks, investors and founders alike.

Who regulates virtual asset businesses

Section 5 of the Act names two relevant regulatory authorities: the Capital Markets Authority (CMA) and the Central Bank of Kenya. It also allows the Cabinet Secretary to designate another public body by gazette notice. Section 6 gives these authorities the function of licensing virtual asset service providers. The First Schedule allocates each activity to a regulator. A custodial wallet provider falls under the CBK, while a virtual asset exchange and a trading, clearing and settlement platform fall under the CMA. A business offering several services should map each one to its regulator before filing, because section 10 requires the application to go to the relevant authority, which may grant the licence with or without conditions or reject the application.

Who can apply for a licence

Section 8 limits eligibility to a company limited by shares registered under the Companies Act, or a foreign company limited by shares registered under that Act. A sole proprietor, partnership or unregistered offshore platform cannot hold a licence. Section 9 ties the permissible activities to the First Schedule. Part IV of the Act then sets continuing duties for licensees, including fit and proper requirements (section 18), a registered office and activities provision (section 19), capital, solvency and insurance requirements (section 22), cyber security measures (section 28), audited annual financial statements (section 29) and protection of customer assets (section 31). The amounts and categories are for the Regulations, so check the current text before sizing a capital plan.

The compliance deadline

Section 47 requires any person already providing virtual asset services to comply with the Act within one year of commencement. The Kenya Law consolidation dates the Act from 4 November 2025, which puts that deadline at 4 November 2026. An existing operator that has not applied should treat the date as close, because licensing involves fit and proper checks, capital arrangements and policy documents that take time to assemble. We discuss the mechanics in our guide to what the VASP deadline requires of existing operators and in our overview of Kenya’s virtual asset licensing regime.

Anti-money laundering obligations

Part V of the Act deals with the prevention of money laundering and terrorism financing, and the Act amends the Proceeds of Crime and Anti-Money Laundering Act, 2009 (POCAMLA). Licensed providers should therefore expect customer due diligence, record keeping, suspicious transaction reporting and a designated compliance function. Our guide to reporting to the Financial Reporting Centre explains how reporting works in practice. We recommend building the compliance manual, customer onboarding procedures and monitoring controls before you file, rather than after, because an applicant that cannot show working controls is more likely to meet questions or conditions from the regulator, and a poorly prepared file can delay a licence beyond the transition date.

Securities tokens, NFTs and sandbox testing

A token that carries rights typical of a share, bond or collective investment scheme can still raise securities-law questions under the Capital Markets Act, whatever label the issuer uses. A token used as a payment instrument raises payment-system questions. Regulatory sandboxes can be a route for novel products; see our note on the regulatory sandbox in Kenya. Whether a particular NFT or decentralised finance product is a regulated activity turns on its economic substance, so cryptocurrency regulation in Kenya should be applied to the specific facts rather than assumed to apply or not apply.

Tax

The tax treatment of virtual asset transactions has been amended by successive Finance Acts. We have not set out rates here, because they change. Check the current Income Tax Act, Value Added Tax Act and Excise Duty Act provisions, or take advice, before you price a product or file a return.