Is DeFi Regulated in Kenya? Non-Custodial Platforms

Decentralised finance, or DeFi, lets people trade, lend and borrow crypto through smart contracts instead of through a company that holds their money. Kenyans use DeFi applications every day. The Virtual Asset Service Providers Act, 2025 never mentions DeFi, and neither do the Virtual Asset Service Providers Regulations, 2026. That silence does not mean DeFi is unregulated in Kenya. It means the answer depends on who is doing what. This article sets out how the Act applies to non-custodial platforms and the people behind them.

The Act regulates persons, not code

The VASP Act licenses businesses. Section 8(2) prohibits any person from carrying on the business of virtual asset services in or from Kenya without a licence, and section 8(1) limits eligibility to companies limited by shares registered under the Companies Act. A smart contract cannot apply for a licence, and it cannot commit an offence. The question is always whether an identifiable person behind the protocol is carrying on a listed activity.

That approach matches the international standard. The Financial Action Task Force’s 2021 guidance on virtual assets says, at paragraph 67, that a DeFi application is not itself a virtual asset service provider, because the standards do not apply to underlying software. The same paragraph says that creators, owners and operators who keep control or sufficient influence over a DeFi arrangement may be VASPs where they provide or actively facilitate covered services, even if parts of the process are automated. Calling a product “decentralised” is not decisive.

Does custody matter?

Partly. Kenya’s Act uses two different descriptions of a trading venue, and they do not match.

• Section 2 defines a “virtual asset trading platform” as one that facilitates trading for third parties for a fee and either holds custody of or controls clients’ virtual assets, or buys from sellers to sell to matched buyers. A truly non-custodial order book that never takes custody or deals as principal falls outside that definition.
• The First Schedule, which actually sets out what needs a licence, describes a virtual asset exchange more broadly: a digital online platform facilitating virtual asset transfers and exchanges, and trading, clearing and settlement platforms. It contains no custody condition.

The licensing obligation runs through the First Schedule (sections 6(1)(a) and 9), so the broader description is the one that matters for section 8. On a plain reading, operating a platform that facilitates the exchange of virtual assets is a licensable activity whether or not the operator takes custody. The narrower section 2 definition matters mainly for section 34, which controls admission of offerings to trading platforms.

Custody does decide which regulator is involved. The First Schedule assigns custodial wallet services to the Central Bank of Kenya and defines a custodial wallet, in section 2, as one where a third party holds and manages the private keys. A protocol where users keep their own keys is not a custodial wallet provider. Whoever runs its exchange function may still need a Capital Markets Authority licence.

Who in a DeFi project is exposed?

Core developers who have moved on. A team that published open-source code, holds no admin keys and earns nothing from usage is in the strongest position. Paragraphs 67 and 82 of the FATF guidance confirm that the standards do not apply to the underlying software itself, only to persons who use it to provide a covered service.

Teams with admin keys or upgrade powers. A team that can pause contracts, change fees, list assets or upgrade the code keeps control or sufficient influence. If the protocol facilitates exchange and the team earns from it, it looks like an operator.

Fee recipients. Regulation 4(2) deems a person to operate in or from Kenya where it derives economic benefit or income from Kenya. A team or foundation collecting protocol fees from Kenyan users meets that limb, even without any Kenyan presence.

DAOs. A decentralised autonomous organisation with no incorporated entity cannot hold a licence under section 8(1). Where a DAO is the operator in substance, the regulator is likely to look to its identifiable controllers, its foundation or the company that runs its interface.

Front-ends. The website that lets users interact with the protocol is often the most visible and easiest to reach. We cover front-end licensing in a separate article on crypto trading apps and front-ends in Kenya.

AML obligations follow the licence

The Act’s Second Schedule amends the Proceeds of Crime and Anti-Money Laundering Act so that a virtual asset service provider is a reporting institution, with the customer due diligence, record-keeping and suspicious transaction reporting duties that follow. Section 21(1)(a) also bars any VASP from offering mixer, tumbler or anonymity-enhancing services. A DeFi operator who is a VASP in substance carries those obligations even if it never applied for a licence.

Practical steps for DeFi teams

1. Map every point of control: admin keys, upgrade rights, fee switches, listing decisions and front-end hosting.
2. Identify every revenue stream that touches Kenyan users, including interface fees and token value accrual.
3. Decide whether to give up control (renounce keys, hand governance to token holders), to license a Kenyan entity for the controlled functions, or to geoblock Kenya at the interface.
4. Document the analysis. Section 4(2)(e) lets the relevant regulatory authority expressly exclude digital representations of value from the Act, and a well-documented position is the starting point for any approach to the CMA or CBK.

Leveraged products are a separate problem. Perpetual futures are derivatives, not virtual assets, and fall under the CMA’s derivatives regime, as we explain in our article on crypto perpetual futures in Kenya.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.