Board Composition and Fit-and-Proper Testing for Kenya’s VASPs: What the Rules Actually Require

Kenya’s Virtual Asset Service Providers Regulations, 2026 do not treat governance as a formality bolted onto a licence application. Part IV sets specific, checkable requirements for board composition and the fitness of the people running the business, and a licensee that gets this wrong at the application stage will not get past the review, regardless of how strong the rest of the business plan is. This is written for boards and company secretaries building out a compliant structure, not founders drafting a pitch deck.

The minimum board

Regulation 42(1) requires a licensee’s board to consist of at least three members, of whom at least one-third must be independent directors. No more than one-third of the directors may be related to any other director. Regulation 42(2) adds a strict separation of roles: the chairperson, or any director, cannot also be appointed as the chief executive officer of the licensee. For a small or founder-led business, this often means recruiting outside directors specifically to meet the licence requirement, not simply formalising an existing informal advisory relationship.

What actually counts as “independent”

Regulation 42(4) defines an independent director narrowly. A person only qualifies if they meet all of the following: they have not been employed by the licensee in an executive capacity within the last five years; they are not associated with an adviser or consultant to the licensee, or with a member of senior management, or with anyone employed by the licensee in an executive capacity within the last five years; they are not associated with a significant consumer or supplier of the licensee, or have not had a business relationship with the licensee within the last five years; they do not have a contract of service with the licensee or with a member of senior management; they are not a close relation of an adviser, consultant, or senior manager; and none of the relationships just described exist with any affiliate of the licensee either.

In practice, this rules out most of the people a founder would think to ask first, such as a long-serving advisor, a major supplier’s representative, or a relative already involved in the business. Genuinely independent candidates usually need to be sourced deliberately, through a structured search, rather than pulled from the founder’s existing network.

The chief executive officer: fit and proper, competent, and domiciled in Kenya

Regulation 44 sets three conditions for anyone to qualify for appointment as CEO of a licensee under section 30(1) of the Act. The person must meet the fit and proper requirements under section 18 of the Act; must possess professional competence in virtual assets or another field relevant to the operations of the virtual asset business; and must be domiciled in Kenya. That last condition is easy to overlook for a foreign-parented applicant, and it is often the requirement that forces the earliest and most consequential hiring decision in the whole licensing process, since a global CEO based abroad cannot simply also serve as the Kenyan licensee’s CEO.

The fit and proper assessment, and where it sits in the application

Fit and proper testing is not confined to the CEO. Regulation 6(2)(a) requires the application itself to include the personal details, qualifications, experience, business interests, and occupation of every director, senior officer, significant shareholder, and beneficial owner. Regulation 6(2)(c) separately requires a duly completed fit and proper assessment form, in the format set out in the Fourth Schedule to the Regulations, covering the same population. Regulation 41(2)(a) then makes it a standing governance requirement, not just an application-stage one: the board itself must consist of persons who meet the fit and proper criteria under section 18 of the Act on an ongoing basis.

A practical documentation checklist for this part of the application therefore covers, at minimum: CVs and qualification evidence for every director, senior officer, and significant shareholder; the completed Fourth Schedule fit and proper form for each of them; a signed independence declaration mapped against the regulation 42(4) test for each director claimed as independent; and, for the CEO, separate evidence of Kenya domicile and relevant professional competence.

What the board is actually responsible for

Regulation 43 defines the board’s role in functional terms rather than leaving it as a general governance obligation. The board is collectively responsible for the conduct and governance of the licensee’s virtual asset business, and specifically must give strategic direction and effective oversight, ensure the integrity of the licensee’s accounting and financial reporting systems, manage the risks affecting the regulated activity with regular review of the risk management process, and ensure the licensee complies with the Act and other relevant laws. The board may set up committees, such as an audit committee or a risk management committee, to help carry this out, but regulation 43(3) is explicit that delegating work to a committee or to management does not discharge the board of its own responsibility for that matter. A board that treats committee reports as a substitute for its own oversight has not satisfied this requirement.

Finance and internal audit functions

Governance requirements extend past the board itself. Regulation 45 requires the persons responsible for the finance function and the internal audit function to be members of good standing of the Institute of Certified Public Accountants, or an equivalent recognised professional body. Boards assembling their senior team should treat this as a hard qualification requirement, not a preference, when hiring into either role.