Kenya's Virtual Asset Regime: The Complete Guide to VASP Licensing

The Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) was assented to on 15 October 2025 and commenced on 4 November 2025. Section 47, its transitional provision, requires anyone already providing virtual asset services in or from Kenya to comply with the Act "within one year of the commencement", placing the deadline at 4 November 2026.

Section 8(2) prohibits carrying on, or holding out as carrying on, virtual asset business in or from Kenya without a licence. Breach is a criminal offence under section 8(3), read with section 40(3): on conviction, an individual faces a fine of up to KES 10 million or imprisonment for up to five years, or both; a company faces a fine of up to KES 25 million. Directors and senior officers who knowingly authorise or permit the breach are personally liable under section 41.

The licensing framework only became operational on 22 July 2026, when the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026) were gazetted. The regulator has thirty days under regulation 6(4) to determine a complete application, and a licensee then has twelve months under regulation 8 to actually commence business. Waiting until October 2026 to start does not leave enough runway.

Which regulator you answer to depends entirely on which activity you carry out, not on how your business describes itself. The Act's own Schedule (sections 2, 6(1)(a), 9(1) and (2)) sets the allocation out category by category.

A single business can hold more than one licence where the activities are genuinely distinct; regulation 6(5) expressly contemplates it. Our clients most commonly pair an Exchange licence with a Wallet Provider licence to cover trading and custody under one roof.

Every applicant pays an application fee and, on grant, a licence fee. Most categories also carry a minimum paid-up capital and a liquid capital requirement maintained at all times, not just at licensing. These figures come directly from the First and Fifth Schedules to the 2026 Regulations.

Two things catch applicants off guard. Investment Advisor is the one category with no minimum capital at all, the cheapest entry point into regulated virtual asset activity in Kenya, though it authorises neither custody, trading, nor issuance. And under regulation 85(6), a business holding more than one licence does not stack full capital for each: it holds the full amount for the highest category, plus fifty percent of the paid-up capital for each additional activity. Try it below.

Every application goes to the relevant regulatory authority for the category concerned, CBK or CMA, and follows the same broad shape: eligibility as a company limited by shares, a complete set of supporting documents under regulation 6(2), fit-and-proper vetting of directors and senior officers, and a thirty-day decision clock that only starts once the file is complete.

Once granted, regulation 8 requires the licensee to commence the licensed business within twelve months, and regulation 9 requires written notice of any material change to the application within two days.

A licence is the beginning of the compliance obligation, not the end of it. Wallet providers face specific segregation, reconciliation and outsourcing requirements under regulations 66 and 113. Directors and senior officers must meet an independence test, and boards need to meet minimum composition requirements before a licence is granted, not arranged afterward. Licensed VASPs also became reporting institutions under the Proceeds of Crime and Anti-Money Laundering Act the moment the Act's consequential amendments took effect, with specific travel rule obligations on transfers. Part XIII of the Regulations separately restricts how virtual asset services can be marketed in Kenya.

Two separate penalty regimes apply. Operating virtual asset business without a licence at all is an offence under section 8(3) of the Act, carrying on conviction a fine of up to KES 10 million or up to five years' imprisonment, or both, for an individual, and a fine of up to KES 25 million for a company. This is the one that bites on 4 November 2026 for anyone still unlicensed. Separately, the Regulations set out narrower penalties for specific compliance failures once licensed: administrative fines of up to KES 3 million or KES 5 million (regulation 142), and criminal sanctions of up to KES 5 million or five years, or KES 8 million for a company (regulation 143), for a shorter list of breaches including misleading the regulator. Regulators can also suspend or revoke a licence outright, often the more commercially damaging outcome.

A VASP licence is only available to a company limited by shares registered under the Companies Act, 2015, or a foreign company registered under the same Act as a branch. Nothing in the Act or the Regulations imposes a local shareholding requirement, so a wholly foreign-owned Kenyan subsidiary or a branch of a foreign company are both live routes; the choice is usually driven by tax and liability considerations rather than the licence itself. Section 10(1)(h) of the Act requires "specified physical premises or data solutions" the regulator considers suitable for accessing and retaining records, so a registered address alone will not satisfy this limb; applicants typically need a real, inspectable office lease in place before filing, not after.

Board and CEO domicile questions come up early for foreign entrants. We cover the independence and fit-and-proper tests in depth separately; on the immigration side, a foreign director, CEO or specialist employee needs a work permit before taking up the role, not after arrival.

Two tax points surprise even sophisticated entrants, and both cut against what is widely assumed online. First, the Digital Asset Tax, the 3% levy on digital asset transfers introduced in 2023, has been repealed. The Finance Act, 2025 removed it from the Income Tax Act entirely; a great deal of commentary still in circulation has not caught up with this. Second, dividend withholding tax is not the 5% or 10% still quoted in older material. The Finance Act, 2025 raised it to a flat 15% for dividends paid to both resident and non-resident shareholders, with a 5% rate preserved only for shareholders who are citizens of an East African Community Partner State.

This is general information, not tax advice for your specific structure. We work with your accountant or tax advisor to confirm the position before you rely on it.