Buying or Selling a Licensed Crypto Business in Kenya: Change of Control Under Regulation 29 and Section 27

Anyone buying into, selling out of, or restructuring the shareholding of a licensed crypto business in Kenya needs to read regulation 29 of the Virtual Asset Service Providers Regulations, 2026 (Legal Notice 134 of 2026) together with section 27 of the Virtual Asset Service Providers Act, 2025. Together they control who may own a licensee, and they do so more tightly than the ten per cent threshold in the Regulations suggests. This article explains the VASP change of control rules for investors, founders and their advisers, and points out a tension between the two instruments that a buyer should not ignore.

VASP change of control: what the Act says

Section 27(1) of the Act provides that no shares in a licensee shall be issued, and no issued shares shall be voluntarily transferred or disposed of, without the approval of the relevant regulatory authority. Section 27(3) makes clear that this covers the transfer or disposal of the legal or the beneficial interest in shares or interests. Section 27(4) deals with shares that vest involuntarily or through process of law: the licensee must tell the regulator as soon as it becomes aware, and must follow the regulator’s instructions about the licence or the business.

Under section 27(2), the regulator may exempt a licensee whose shares are publicly traded on a licensed Kenyan exchange or a recognised overseas exchange. The exemption is conditional. The licensee must notify the regulators as soon as reasonably practicable of any change in control, of any acquisition of more than ten per cent of its issued share capital or voting rights, and of any such acquisition in its parent company. It must also give the regulator, within the time the regulator sets, the information needed to assess whether the persons acquiring control or ownership are of satisfactory repute.

A breach of section 27(1) or (4) is an offence under section 27(5). Section 40(1) sets the penalty: for an individual, a fine of up to KES 3 million, imprisonment of up to three years, or both; for a company, a fine of up to KES 5 million.

What regulation 29 adds

Regulation 29(1), made pursuant to section 27, draws a line at ten per cent. A person who wishes to acquire, transfer or dispose of, directly or indirectly:

1. not more than ten per cent of the shares or an interest in a licensee must notify the relevant regulator in writing before the acquisition, transfer or disposal; and
2. more than ten per cent must seek the regulator’s approval.

An application for approval under regulation 29(2) must be in writing, be accompanied by the fee in the First Schedule, and give the regulator enough information to assess the nature of the proposed transaction, the identity of the acquirer or the target and anyone who controls or manages the acquirer, and how the transaction is to be financed.

How the regulator decides

Regulation 29(3) lists what the regulator must have regard to:

1. the suitability and character of the proposed acquirer;
2. the acquirer’s ability to conduct the licensee’s business in the long term;
3. the reputation, knowledge, skills and experience of those who will direct the business;
4. the fitness and probity of new directors, significant shareholders and senior officers;
5. the financial soundness of the transaction;
6. the acquirer’s source of funds;
7. whether the licensee will be able to keep complying with the Act and the Regulations; and
8. whether there are reasonable grounds to suspect financial crime, money laundering, terrorism financing or proliferation financing in connection with the transaction, or that it could increase that risk.

The regulator must notify its decision within ten days of making it (regulation 29(4)). It may consult the authorities responsible for mergers and acquisitions and for AML/CFT/CPF (regulation 29(6)). The list makes the source of the buyer’s funds and the quality of its ultimate owners central, not incidental. See our guide to board composition and fit-and-proper testing for VASPs.

Anti-avoidance

Regulation 29(5) closes two obvious routes. A person who reduces a direct or indirect shareholding to less than ten per cent in order to avoid the approval requirement, or who exercises control over more than ten per cent through associates or proxies, must obtain the regulator’s approval for the transfer or disposal. Splitting a stake among nominees does not avoid the rule.

The tension a buyer should not ignore

Read on its face, regulation 29 allows a transfer of up to ten per cent on prior notice, while section 27(1) of the Act requires the regulator’s approval for any voluntary transfer of shares in a licensee. Regulations made under the Act would ordinarily be read subject to it. A buyer or seller who relies on the notification limb of regulation 29 for a small stake is therefore taking a position that the text of section 27(1) does not obviously support. We have not found guidance from the Central Bank of Kenya or the Capital Markets Authority on how the two provisions are to be reconciled. Until there is guidance, the safer course is to ask the regulator, in writing, whether it treats a notified transfer of up to ten per cent as effective without a separate approval. The consequence of getting it wrong is an offence under section 27(5).

Fees and timing

The First Schedule sets an approval fee for a proposed acquisition, transfer or disposal of shares in a licensee of 0.25 per cent of the transaction value or KES 50,000, whichever is higher. A separate fee, equal to the licence fee for the category, applies to approval of the assignment or transfer of a licence itself. Regulation 29(4) gives the regulator ten days to notify its decision once it has made it, and we found no fixed deadline in regulation 29 for making the decision itself. Build regulator approval into the conditions precedent and the long-stop date of any share purchase agreement.

Practical steps for buyers and sellers

1. Treat regulator approval of the transfer as a condition precedent in the share purchase agreement, with a long-stop date that allows for the regulator’s due diligence.
2. Prepare the acquirer’s ownership chain, source-of-funds evidence and details of the people who will control the business before you file.
3. Include new issues of shares in the analysis. Section 27(1) covers the issue of shares as well as transfers, so a funding round needs approval too.
4. Look through nominee holdings. Section 27(3) covers beneficial interests, and regulation 29(5) covers proxies.
5. Take written confirmation from the regulator on any transfer you think falls under the ten per cent notification limb.
6. Read the change of control rules alongside our guide to acquiring a licensed financial services business.