Regulation 6 of Kenya’s Virtual Asset Service Providers Regulations, 2026 is the single most consequential provision in the whole framework for a business trying to get licensed, because it is the checklist the regulator actually works from. Most delays in the process come from applicants underestimating what regulation 6(2) requires document by document, not from any dispute over the underlying business model. This is a walk-through of what the application actually demands, and how long the regulator has to decide once it is complete.
Where the application is filed, and in what form
Under regulation 6(1), an application for a licence to offer one or more of the permissible activities listed in section 10(1) of the Act must be made in the form set out in the Second Schedule to the Regulations. Which regulator receives it depends on the activity: the Central Bank of Kenya for wallet-provider and stablecoin-issuance activities, the Capital Markets Authority for exchange, token-issuance, and tokenisation activities. An applicant offering more than one category of activity may need to satisfy more than one regulator with a coordinated, but not identical, set of applications.
The document list, category by category
Regulation 6(2) lists the required accompanying documents. Grouped by function, an applicant needs to assemble:
People. Personal details, qualifications, experience, business interests, and occupation for every director, senior officer, significant shareholder, and beneficial owner; a completed fit and proper assessment form (Fourth Schedule) for the same group.
The business itself. A business plan prepared in accordance with the Third Schedule; proof of source of funds; a description of the systems and controls of the proposed business; and copies of any contracts or arrangements for oversight of activities.
Policies. A full operational policy suite covering risk management, AML/CFT/CPF, data protection and privacy, cybersecurity and information technology, complaints management, market conduct, consumer protection, conflict of interest, and a business continuity and disaster recovery plan. This is nine separate written policies, each of which needs to actually reflect how the business will operate, not a template downloaded and lightly edited.
Money. Evidence of paid-up capital and liquid capital at the level set out in the Fifth Schedule for the specific licence category applied for; three years of audited financial statements, or opening financial statements verified by an auditor for a newly incorporated applicant; and, where the applicant is a subsidiary of a foreign parent, three years of the parent’s audited consolidated financial statements.
Technical assurance. Evidence of the human and technology resources required under regulation 18; and an independent information systems audit report, including a vulnerability assessment and penetration test, from a person with the relevant qualifications.
Disclosure and compliance. Full disclosure of cross-border operations, affiliates, and related-party arrangements; the register of beneficial owners issued by the Registrar of Companies; and proof of payment of the application fee under the First Schedule.
The interview, and the thirty-day clock
Regulation 6(3) allows the relevant regulatory authority to require an applicant to participate in an interview to obtain further information about the application. This is not automatic for every application, but applicants should expect it, particularly where the business plan or ownership structure raises questions on paper.
Regulation 6(4) then sets the timeline that matters most for planning purposes: within thirty days of receipt of all documents and information required under regulation 6(2), and completion of due diligence on the applicant, the relevant regulatory authority must determine the application and notify the applicant of the decision. The clock only starts once the file is genuinely complete. An application submitted with gaps does not start a thirty-day countdown; it starts a round of correspondence that resets the effective start date once the missing material is finally in.
Why the sequencing matters
Several of the regulation 6(2) items depend on decisions that themselves take time: the fit and proper assessment depends on having assembled a compliant board under Part IV’s governance requirements; the capital evidence depends on having actually raised or allocated the funds; the information systems audit depends on the systems existing in a testable state. Applicants who treat regulation 6(2) as a document-collection exercise to run in the final weeks before filing consistently find they are still assembling governance, capital, or technical evidence when they meant to be filing. Building the application file in parallel with the underlying corporate and technical work, rather than after it, is what actually keeps a business inside the thirty-day clock rather than outside it.
What “due diligence” adds on top of the document review
Regulation 6(4) ties the thirty-day clock to two things happening together: receipt of everything required under regulation 6(2), and completion of due diligence on the applicant. That second element is not simply reading the file. It covers verifying the source-of-funds evidence, cross-checking the beneficial ownership register against the disclosed shareholding, and satisfying the regulator on matters raised at interview under regulation 6(3) where one is held. Applicants sometimes assume that once every document on the checklist has been submitted, the clock is already running. In practice, if due diligence raises a question that requires further information, the thirty-day period does not begin until that question is resolved, which is another reason to treat the interview stage as a normal, expected part of the timeline rather than a sign that something has gone wrong with the application.
How We Can Help
Clay & Associates Advocates prepares VASP licence applications end to end, including the governance, policy, and disclosure documentation regulation 6(2) requires, and coordinates parallel filings where an applicant needs both a Central Bank of Kenya and a Capital Markets Authority licence. See our guides to board composition and fit-and-proper testing and to Kenya’s virtual asset licensing regime for the requirements that feed into this application. Contact our Regulatory & Compliance practice before you start assembling documents, not after.
Sources: Virtual Asset Service Providers Regulations, 2026 (Legal Notice 134 of 2026), regulation 6.
Frequently asked questions
How long does a VASP licence application take from filing to decision?
The regulator has thirty days to decide once the file is complete and due diligence is finished, under regulation 6(4). The time spent assembling a complete file beforehand is usually longer than the thirty-day decision period itself.
Does the thirty-day clock start when I submit my application?
No. It starts once all required documents and information under regulation 6(2) have been received and due diligence is complete, not on the date of first submission.
Will every applicant be interviewed?
Regulation 6(3) makes an interview discretionary for the regulator, not automatic, but it should be expected as a normal part of the process.
What if I am applying for both a wallet-provider and an exchange licence?
Each activity category under section 10(1) of the Act is its own permissible activity, and different categories may fall to different regulators, so a multi-category applicant should expect coordinated but separate applications.
