Already Running a Crypto Business in Kenya? Here’s What 4 November Requires

If you’re already running a crypto exchange, a wallet service, or a fintech product with a crypto feature bolted on, and you’re operating in or into Kenya, one date matters more than the industry seems to be treating it: 4 November 2026. This is written for you specifically, not someone weighing whether to enter Kenya, but someone already there, working out what the deadline actually requires.

Where the deadline comes from

The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025. Its transitional clause, section 47, is one sentence: existing operators have one year to “comply with the provisions of this Act.” No detail on what compliance actually means. No softer track for businesses already running versus starting fresh. One year from commencement is 4 November 2026, and that’s the date.

The question most people skip: are you actually in scope?

Section 8(2) is worth reading closely: you can’t carry on virtual asset business “in or from Kenya” without a licence. That phrase does real work. It isn’t limited to Kenyan-incorporated companies or Nairobi offices. A foreign exchange with no local entity, no local staff, and no local bank account can still be in scope if it serves Kenyan customers or takes Kenyan payment methods. If you have Kenyan users, being headquartered elsewhere doesn’t take you out of the conversation.

A few scenarios people talk themselves out of, wrongly: an app registered abroad that happens to accept Kenyan mobile money. A regional fintech that bolted a crypto top-up onto an existing wallet without treating it as its own regulated line of business. A business that genuinely believed it was just a “technology provider” to a licensed partner. None of these are decisive on their own. What matters is the activity you’re actually carrying on and who it’s for, not the story built around it.

What “comply within one year” actually means

This is where we’d rather be honest than confident, because the text doesn’t spell it out. Section 47 alone could mean “hold a granted licence by 4 November” or something looser, like “be genuinely working through the process by then.” Section 8(2)’s wording, “unless licensed,” leans toward the stricter reading. It doesn’t say “unless you’ve applied.”

The real problem is timing. The Act gave a year, but the detailed Regulations, the ones with the actual application form, fees, and capital thresholds, only arrived on 22 July 2026. Regulators then have thirty days to decide a complete application. Fine, once you’re ready to submit. It says nothing about how long it takes to get ready: restructuring capital, rebuilding a board, gathering fit-and-proper paperwork on every director. For a business starting that work only once the regulations existed, the window is genuinely tight, and neither the Act nor the Regulations offer an explicit bridge for someone who applied in time but simply hasn’t been decided yet.

What actually happens if you miss it

Two enforcement tracks, worth knowing precisely rather than vaguely fearing.

Administrative: under section 39, the regulator can issue a warning, order remedial action, restrict new contracts, force out a director, or suspend or revoke a licence. Some contraventions carry fines up to KES 3 million for an individual or KES 10 million for a company.

Criminal: separate, and more serious. Section 8(3) makes unlicensed operation an offence. Section 40(3) sets the penalty at up to KES 10 million or five years for an individual, and up to KES 25 million for a company. Section 41 extends that to any director or senior officer who knowingly allowed it. This isn’t only a company problem.

Neither kicks in automatically on 5 November. Criminal liability needs a conviction; administrative action is a regulatory decision, not a switch. But the exposure is real and specific, and it reaches individuals, not just balance sheets.

The one genuinely useful thing the Act tells you

Section 39(3) lists what the regulator must weigh before acting: “the conduct of the individual or company after the violation,” and their “previous disciplinary record and compliance history.” That’s not a safe harbour, and a pending application doesn’t excuse non-compliance on paper. But a business that’s genuinely engaged, submitted a complete application, answered every query, and built a real paper trail is in a different position than one that’s done nothing and hoped.

What that paper trail looks like is specific, not a feeling. Regulation 6(2) already tells you: a fit-and-proper form for every director and senior officer, a business plan meeting the Third Schedule, evidence of your capital, a full policy suite (risk management, AML/CFT, data protection, cybersecurity, complaints, conflicts of interest), and full disclosure of your operations elsewhere. Submit all of that, even without a decision yet, and you have something concrete to point to. Send a one-page letter of intent, and you don’t.

What we’d actually tell a client

Work out definitively whether section 8(2) catches you, based on where your customers actually are, not where your servers or your holding company sit. If it does, start now, whether or not a granted licence by 4 November looks realistic, since the factors the regulator must weigh reward genuine effort over silence. Keep a dated record of every submission and every interaction. Prioritise the fit-and-proper documents and policy suite over the paperwork that looks easiest, since those take longest to build and a regulator will notice if they’re thin. And don’t assume the whole industry being in the same boat means the deadline quietly moves. That’s a bet on forbearance, not a right in the text.

None of this is meant to alarm. It’s meant to replace a vague sense of “the deadline is coming” with an accurate one: what the law says, what it doesn’t, and what’s actually in your control before 4 November.