Kenya VASP Licensing & Compliance Resource Centre
The central hub for licence categories, CBK/CMA jurisdiction, costs, AML and the transition deadline.
Read insight →A recurring first question from founders is simple: who do I actually apply to? The Act answers this by dividing regulated virtual asset activities between the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA), with the Cabinet Secretary for the National Treasury able to designate further authorities by Gazette notice. The allocation is defined activity by activity in the Act and its schedules, not by a general rule of thumb, so each licence category should be checked individually.
Do not rely on a simple "payments vs markets" shorthand
It is tempting to summarise the split as "CBK handles payments and issuance, CMA handles markets and investments." That shorthand is directionally useful but legally unsafe to rely on for a specific application, since the Act allocates supervision by defined activity rather than by that general theme. Always confirm the regulator for your specific licence category against the current Act and Regulations before proceeding.
Indicative activity-by-activity allocation
| Activity | Regulator (indicative) | Key regulatory focus |
|---|---|---|
| Virtual Asset Exchange | CMA | Market integrity, custody, systems resilience |
| Virtual Asset Wallet Provider (custodial) | CBK | Asset segregation, capital, operational resilience |
| Virtual Asset Payment Processor | CBK | Payment flows, conversion disclosure, FX compliance |
| Virtual Asset Broker | CMA | Best execution, conflicts of interest, disclosure |
| Virtual Asset Investment Adviser | CMA | Suitability, conflicts, compensation disclosure |
| Virtual Asset Manager | CMA | Discretionary mandate governance, asset protection |
| Initial Coin Offering / Virtual Asset Offering | CMA | Disclosure, use of proceeds, investor protection |
| Virtual Asset Tokenisation / Token Issuance Platform | CMA | Underlying asset rights, custody/trustee arrangements |
| Trading, Clearing & Settlement Platform (Reg. 53 approval) | CMA | Systems resilience, real-time trade transparency, record retention |
| Stablecoin Issuance | CBK | Reserve backing, redemption rights, disclosure |
This table is indicative and intended to orient founders before a detailed classification exercise. It should be verified against the current First Schedule and Regulations for your specific business model, since the Cabinet Secretary may also designate further authorities for activities not squarely covered above.
Why a single business may need to engage both regulators
Many digital-asset businesses do not fit neatly into one category. A platform that both custodies customer assets and operates a trading venue, for example, combines a CBK-oriented function with a CMA-oriented one. In that situation, the practical approach is to map each distinct activity the business performs against the licence categories separately, rather than assuming a single licence covers everything the platform does.
What this means for structuring
Understanding the regulator split early affects more than the application form. It shapes board composition and expertise, the content of your AML/CFT programme, your capital planning, and even which activities you may want to spin out into a separate corporate entity to keep licensing and supervision cleaner. Founders building a multi-sided platform should map their activity list against both regulators before finalising the product architecture.
Getting classification right
Regulatory classification depends on what the platform actually does, how customer assets and funds move, and which services are genuinely provided, not on how the product is described in a pitch deck or whitepaper. We work through this analysis with founders before an application is drafted, so the application is directed at the correct regulator from the outset.
Where the Regulations name the regulator directly
The Virtual Asset Service Providers Regulations, 2026 name the applicable regulatory authority explicitly for several activities, which grounds the indicative table above in the statutory text rather than general inference:
- Initial coin offerings, virtual asset tokenisation, and token issuance platform listings are administered by the Capital Markets Authority. Part VII of the Regulations, governing tokenisation of real-world assets, is explicit that an applicant "shall make an application to the Capital Markets Authority for a licence," and Regulation 60 places the listing requirements for virtual asset exchanges and token issuance platforms with the CMA as well. Separately, Regulation 53 requires a person seeking to deploy a trading system or platform to apply in writing to the CMA for approval; the Regulations do not state a fixed determination period for that approval, only that the CMA must notify the applicant of its decision within ten days of making it. The CMA also maintains the public register of approved offerings and retains the power to direct delisting of a virtual asset where a material risk to financial stability or consumer protection arises.
- Stablecoin issuance and the conversion of virtual assets to or from foreign currency are administered by the Central Bank of Kenya. A virtual asset exchange may not list a stablecoin unless the Central Bank of Kenya has approved it and it is issued by a duly licensed stablecoin issuer, and a person seeking to transact the business of converting virtual assets to or from foreign currency must apply to the Central Bank of Kenya for authorisation before commencing that business.
This activity-by-activity allocation is the reason a blanket "payments versus markets" summary is unsafe to rely on for a specific filing: the correct regulator is a function of the specific permissible activity being licensed, as named in the Act and Regulations, not a theme inferred from the business's general description.
Coordination between the regulators
The Regulations establish a Coordination Forum, chaired by the National Treasury and including the Central Bank of Kenya among its members, to coordinate regulatory approach across agencies with an interest in virtual asset activity. This reflects the reality that a business spanning more than one activity may need engagement with more than one authority, and that the regulators are expected to coordinate rather than operate in silos.
Unsure which regulator applies to your model?
We map your specific activities against the Act’s licence categories to confirm CBK, CMA, or both.
Request a Licence Classification ReviewKey legal & regulatory sources
- Kenya Law — Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025)
- Kenya Law — Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026)
- Central Bank of Kenya and Capital Markets Authority public guidance on VASP licensing
Frequently asked questions
Can one company hold both a CBK and a CMA virtual asset licence?
Yes, where the business genuinely carries on regulated activities that fall within both regulators' jurisdiction. Each activity is assessed and licensed on its own terms.
Who decides which regulator has jurisdiction over a new type of virtual asset activity?
The Act designates the regulators for defined categories of activity, with the Cabinet Secretary for the National Treasury able to designate additional authorities by Gazette notice for activities not otherwise squarely allocated.
Does the CBK or CMA regulate virtual asset advertising and marketing?
Consumer-facing conduct, disclosure and marketing standards generally fall to whichever regulator licenses the underlying activity, so a platform should expect its marketing practices to be reviewed as part of that regulator's ongoing supervision.
Related insights
Fintech,
Fintech,
How to Apply for a VASP Licence in Kenya: Step-by-Step Guide
A practical roadmap through classification, application preparation and regulator engagement.
Read insight →The information on this website is general in nature, is not legal advice, and does not create an advocate-client relationship. Figures, fees, capital thresholds and procedural requirements under the Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026 should be confirmed against the current Gazette text and regulator guidance before action is taken. Please contact Njau & Associates Advocates for advice on your specific circumstances.