Frozen Wallets and Seized Assets: What Kenya’s VASP Regulations Require Under Part XIV

A licensed exchange or wallet provider in Kenya will, sooner or later, be served with an order to freeze or hand over a customer’s virtual assets. Part XIV of the Virtual Asset Service Providers Regulations, 2026 (Legal Notice 134 of 2026), regulations 134 to 141, sets out exactly what a licensee must do when freezing and seizure orders arrive, and makes failure a criminal offence. The commentary on the new regime has concentrated on licensing and capital, so this Part has had little attention. This article explains what it requires.

What Part XIV freezing and seizure orders cover

Regulation 134 does not create a new source of power. Under regulation 134(1), a freezing or seizure order must be obtained in accordance with the procedures and evidentiary requirements of the Proceeds of Crime and Anti-Money Laundering Act, the Anti-Corruption and Economic Crimes Act, or any other relevant law on identifying, tracing, seizing or forfeiting the proceeds of crime. Regulation 134(2) then applies the investigation, preservation, seizure, production, compensation and forfeiture powers under those laws to virtual assets and to virtual asset service providers. Regulation 134(3) preserves the competent authority’s ability to seek other orders for recovery of virtual assets that are proceeds of crime or unexplained assets.

In other words, the Regulations extend existing asset-recovery machinery to crypto and tell the licensee how to respond. For the underlying court process, see our guide to freezing orders and asset recovery under POCAMLA.

Duties when a licensee is served with a freezing order

Regulation 135 imposes a general duty: every licensee must comply with any freezing order and seizure order. That includes responding promptly to lawful requests for information, giving access to virtual asset transaction records, customer identification data and beneficial ownership information, producing what the order specifies, maintaining systems and procedures that allow timely and effective responses, and cooperating in executing court orders, warrants and directives.

Regulation 136 then lists what a licensee served with a freezing order must do:

1. immediately freeze the specified virtual assets;
2. prevent withdrawal, transfer or conversion related to the frozen assets;
3. preserve all records relating to them, including customer information, transaction logs, wallet addresses, keys and any other relevant data;
4. ensure that any internal or third-party custodian, sub-custodian, exchange partner or distributed ledger infrastructure provider it uses also complies, to the extent that provider controls the assets; and
5. comply with the competent authorities and supply the documents, records and technical information the order requires, including addresses or accounts, customer identification records, and transaction histories, logs and metadata.

The fourth item matters most in practice. A licensee that outsources custody or routes through an exchange partner cannot treat the freeze as somebody else’s problem. Its contracts with those providers need to oblige them to act on a freeze at the licensee’s instruction. Our guide to custody obligations for wallet providers covers the outsourcing rules.

Duties when a licensee is served with a seizure order

A seizure order is more intrusive, because control moves to the State. Under regulation 137, the licensee must immediately surrender control of the specified assets to the competent authority, give full access to the relevant wallets, addresses or accounts and digital records, and transfer the assets to a designated secure wallet controlled by the competent authority. It must provide the transaction histories and technical information needed to enforce the order. It must also allow an authorised officer access to premises where the virtual asset devices are suspected to be, and the officer may seize and detain physical devices, hardware wallets and seed phrase backups.

Once the assets are seized, regulation 138 requires the authorised officer to take reasonable measures to maintain their value and integrity, and permits conversion into fiat currency to preserve value, but only with the approval of the competent court. Regulation 139 requires the assets to be held in a secure wallet controlled by the relevant government agency, with a detailed chain-of-custody record, including transaction hashes and transfers, and monitoring of value.

Protecting customers who are not involved

Custodial platforms hold many customers’ assets, sometimes in pooled wallets. Regulation 140 addresses that risk. A freezing or seizure order must target specific customer accounts or specific virtual assets held in custody by the licensee, and must make provision for the licensee to seek clarification or variation where compliance would affect the assets of uninvolved customers.

That is a useful safeguard, but it only works if the licensee can show which assets belong to whom. Segregation and reconciliation records are therefore part of the response to an order as well as a licensing requirement. In the text we read, we did not find a provision on whether the licensee may tell the affected customer of the order, so take advice on that point before deciding how to communicate.

Penalties for non-compliance

Under regulation 141, a licensee that fails to comply with a freezing or seizure order commits an offence and is liable on conviction to the penalty in regulation 143. For an individual, that is a fine of up to KES 5 million, imprisonment of up to five years, or both. For a company, it is a fine of up to KES 8 million. The Regulations also contain administrative sanctions in regulation 142, which can include suspension or revocation of a licence.

What licensees should build now

1. Name a person and a backup who can receive and act on an order at any hour, and record how orders will be verified as genuine.
2. Prepare a freeze procedure that stops withdrawals, transfers and conversions for the specified assets and preserves keys, logs and metadata.
3. Amend outsourcing and custody contracts so that every custodian, sub-custodian and partner must act on a freeze.
4. Keep customer-level records precise enough to isolate specified assets without touching uninvolved customers, and know how to ask for a variation under regulation 140.
5. Prepare for a seizure: who holds the private keys, how a transfer to an authority-controlled wallet would be executed, and how physical devices and backups are stored.
6. Check that your terrorism-financing freeze procedure under Legal Notice 172 of 2026 and your Part XIV procedure are consistent, since they are separate regimes with separate triggers.