Listing a Token on a Kenyan Exchange: Regulation 33

Every token listed on a licensed Kenyan exchange now has to pass a due diligence process set by law. Regulation 33 of the Virtual Asset Service Providers Regulations, 2026 (Legal Notice 134 of 2026) tells exchanges and token issuance platforms what they must look at before admitting a virtual asset for trading, and what they must keep doing afterwards. For token projects hoping to list in Kenya, it is effectively the listing checklist. This article walks through it, together with the other listing rules that sit around it.

Who regulation 33 applies to

Regulation 33 binds virtual asset exchanges and token issuance platform providers, both licensed by the Capital Markets Authority under the First Schedule to the Virtual Asset Service Providers Act, 2025. It does not bind token issuers directly. In practice, though, issuers will be asked to supply most of what the exchange needs, so they should prepare as if it applied to them.

A wider duty sits in the Act itself. Section 24(r) of the Virtual Asset Service Providers Act, 2025 requires every virtual asset service provider that offers a virtual asset for sale to conduct due diligence on the asset and its issuer. So a licensed broker that offers a token to clients, even without listing it, carries a parallel obligation. Regulation 33 simply sets out, for exchanges and platforms, what that due diligence must cover.

The consequences of getting it wrong are not only regulatory. An exchange that lists a token without a defensible file is exposed if the token collapses, is exploited or turns out to be a security. Clients who lose money will look first at the exchange that gave the token credibility by listing it.

The nine factors

Regulation 33(1) requires due diligence on all virtual assets before they are included for trading. Regulation 33(2) lists what the exchange must take into consideration:

1. Regulatory status. What the asset is in law and whether that status changes the exchange’s own obligations. A token that is in substance a security, a stablecoin or a derivative raises different questions.
2. Supply, demand, maturity and liquidity. Thin, immature markets are easier to manipulate.
3. Complexity and development. How the asset works and how far its project has progressed.
4. Risks of the asset and its issuer. Including the issuer’s identity, governance and track record.
5. Enforceability of consumer rights. What a holder can actually enforce, and against whom.
6. Market capitalisation and trading volume.
7. Technical security audits, including smart contract reviews.
8. Project fundamentals, such as token distribution and community support.
9. Legal and compliance assessments, including AML/CFT/CPF safeguards and avoidance of regulatory risk.

The list is a set of considerations, not a pass mark. An exchange is expected to weigh them and record its reasoning.

Record-keeping and ongoing monitoring

Two obligations continue after listing. Under regulation 33(3), the exchange must keep the record of its due diligence assessment for as long as the asset remains listed. Under regulation 33(4), it must continuously monitor each listed asset to decide whether it remains viable for trading or should cease trading.

That second duty matters. A token that was sound at listing but later loses liquidity, suffers an exploit or changes its governance must be reassessed, and the exchange must be able to show it did so.

The rules around regulation 33

Due diligence is only one part of the listing picture. Regulation 60 adds:

• an official list of all assets on the exchange (regulation 60(1) and (2));
• a condition that an asset may only be included where it has reached the minimum total subscription disclosed in the white paper approved by the CMA for its initial offering (regulation 60(3));
• monthly notification to the CMA of each listing or delisting decision, by the tenth of the following month (regulation 60(5));
• a bar on listing any stablecoin that the Central Bank of Kenya has not approved and a licensed issuer has not issued (regulation 60(6)); and
• a CMA power to direct delisting where material risk to financial stability or consumer protection is identified (regulation 60(7)).

Regulation 60(3) raises a real interpretive problem. Read literally, it would prevent listing any asset that never had a CMA-approved white paper, including bitcoin and most established tokens. It was almost certainly written for Kenyan token offerings, but exchanges should get the CMA’s view in writing rather than assume. We discuss the stablecoin bar in our article on whether Kenyan exchanges can list USDT or USDC.

For new Kenyan tokens, section 34 of the Act separately requires the issuer to obtain approval before issuing an offering in or from Kenya or seeking admission to a trading platform.

A practical file for token projects

Projects approaching a Kenyan exchange should arrive with:

• a legal opinion on the token’s status under Kenyan law, including whether it is a security, a stablecoin or a derivative;
• independent smart contract audit reports and a record of any incidents since;
• token distribution data, vesting schedules and treasury holdings;
• identities and backgrounds of founders, directors and controllers;
• evidence of trading volume and liquidity on other venues; and
• a summary of holder rights and how they are enforced.

Projects that cannot produce these will struggle to list, and exchanges that list them anyway take the regulatory risk.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.