Going First: What Kenya’s New Crypto Licensing Law Actually Requires

Kenya now has a real licensing regime for crypto businesses. Here’s the part that doesn’t make the headlines: nobody has actually been licensed under it yet. The rules only became clear a few months ago, and the compliance deadline lands before most businesses can realistically be ready. This is our plain explanation of what the law requires, drawn from real advisory work under it, with every claim linked to its primary source. It also updates and goes well beyond our earlier overview of cryptocurrency regulation in Kenya, written before the licensing regime described below actually existed.

The two documents you need

Two things matter here. The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025 and sets the framework. The Virtual Asset Service Providers Regulations, 2026, gazetted as Legal Notice 134 on 22 July 2026, set the actual numbers: fees, capital, forms, procedure. You need both. Until July 2026, only half of this existed.

Who regulates what

The Act splits crypto activity between two regulators, and which one applies depends on what you actually do, not what you call yourself. The Central Bank of Kenya handles wallet providers (anyone holding customer keys in custody), payment processors, and stablecoin issuers. The Capital Markets Authority handles exchanges, brokers, investment advisers, asset managers, and anyone issuing or tokenising assets. Run a trading platform and hold customer assets? You need a licence from each regulator. Two applications, two sets of obligations, two relationships to manage.

One distinction matters more than it looks. An exchange matches trades itself. A broker routes client orders through someone else’s platform. The two carry very different capital requirements, so how your platform actually executes trades, not how your marketing describes it, decides which one you are.

Capital: the number that stacks

Minimum paid-up capital ranges from nothing for investment advisers to KES 300 million for stablecoin issuers. Wallet providers sit at KES 150 million, exchanges at KES 100 million, brokers at KES 10 million. Need more than one licence? Regulation 85(6) makes you hold the highest category in full, plus 50% of paid-up capital for each additional activity. A wallet-provider-plus-exchange business isn’t looking at KES 250 million. It’s KES 150 million plus half of KES 100 million: KES 200 million. Price each licence in isolation and you’ll get this wrong.

There’s a liquid capital layer on top of that, and regulation 85(11) requires net worth, not just your initial injection, to stay above the floor at all times. Capitalise right at the minimum and ordinary early losses can push you out of compliance within months.

Governance: more than adding a local name

Regulation 42 requires at least three directors, one-third of them independent, with separate chair and CEO. The independence test in regulation 42(4) is specific: no executive role, advisory relationship, or material commercial tie to the licensee in the last five years. A locally resident director isn’t automatically an independent one, those are two different boxes. Regulation 44(c) separately requires the CEO to be domiciled in Kenya, a higher bar than simply holding a work permit.

Custody: you can outsource the work, not the licence

This is the question we found hardest to answer from the text alone, and it comes up constantly. Don’t want to hold customer crypto directly? You can engage a third-party custodian. Regulation 113 allows outsourcing, subject to the regulator’s approval at least 30 days before it starts. But regulation 113(4) is explicit: outsourcing doesn’t dilute your responsibility to your customers, and the regulator keeps oversight rights over whoever does the work. Regulation 66 then requires you to segregate customer assets from your own, hold them on separate ledger addresses, and reconcile monthly. The application form itself, under regulation 6(2)(g), makes you disclose any outsourcing arrangement.

Put together: the business offering custody needs the wallet-provider licence itself, even if a vendor does the technical work. No single provision says this in one sentence. It’s assembled from three different parts of the regulations, so reading any one in isolation could send you the wrong way.

Now, the honest part

The timeline doesn’t add up. Existing operators have until 4 November 2026. But the regulations that make compliance actually possible only arrived on 22 July 2026. That’s roughly three and a half months to raise or restructure capital, rebuild a board, recruit a Kenya-domiciled CEO, write a full compliance policy suite, and file a complete application, against a regulator that, as late as August 2026, specialists still weren’t sure was fully open for applications. Thirty days to decide a finished application is reasonable. It says nothing about how long it takes to build one.

Renewal timing is genuinely unclear. A licence renews annually, filed two months before expiry, but nothing in the text says whether that clock runs from your grant date or resets on a fixed calendar date. A neighbouring provision, on fiat-conversion authorisations, does fix expiry to 31 December. So does every licensee’s financial year. Whether the base licence follows suit isn’t spelled out, and it changes whether a business licensed in October is renewing again in weeks or in a year. We’d rather flag that as open than guess.

There’s no transitional tier. Existing operators face the same deadline and the same full application as a brand-new entrant, with no lighter bridging licence to operate under while a full application gets built. Other regimes phasing in similar rules usually include one.

Liquid capital stacking isn’t addressed. Regulation 85(6) spells out exactly how paid-up capital stacks across multiple licences. It says nothing about whether liquid capital does the same. That’s a real balance-sheet number, and it shouldn’t be a guess.

The two-regulator model is untested. Splitting supervision between the Central Bank and the Capital Markets Authority can work well, once both sides have a track record of coordinating. With zero licences issued so far, nobody outside the regulators knows yet how smoothly that will actually run.

What this means if you’re navigating it now

None of this is a reason to wait. It’s a reason to go in with your eyes open. Read the regulations directly, not a secondhand summary. Describe your business precisely enough to test against the Act’s actual definitions. Say “the law doesn’t settle this yet” instead of guessing with false confidence. Build your plan around what happens after the licence, not just what it takes to get one. Going first into an untested regime costs something. Done properly, it’s also a real head start.