How to Apply for a VASP Licence in Kenya: Step-by-Step Guide

The Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026) give Kenya, for the first time, a defined licensing process for exchanges, wallet providers, payment processors, brokers, advisers, managers, and token or stablecoin offering providers. This is a practical roadmap through that process.

Step 1: Confirm whether you need a licence at all

Before assembling any documents, establish whether your business carries on a regulated virtual asset activity in or from Kenya. The test looks at substance, what the business actually does with customer funds, assets and data, not at how the product is marketed. A platform that custodies assets, operates a trading venue, processes crypto-fiat payments, advises on or manages virtual assets on behalf of clients, or issues a token, stablecoin or virtual asset offering will generally fall within scope.

Step 2: Identify the correct licence category and regulator

The Act creates a dual-regulator model. Broadly, market and investment-facing functions, such as exchanges, tokenisation and investment services, sit with the Capital Markets Authority, while payment-oriented functions, such as stablecoin issuance, payment processing and custodial wallets, sit with the Central Bank of Kenya. A business performing more than one function may need to consider its position under both regulators. See our CBK vs CMA guide for the full breakdown.

Step 3: Get the corporate structure right

Applicants are expected to operate through an eligible corporate vehicle under the Companies Act, 2015, which may be a Kenyan company limited by shares registered under the Act, or an eligible foreign company limited by shares registered under the Act, with clear shareholding and beneficial ownership records. Foreign-owned groups should plan the local entity, ownership structure and any future capital-raising or ownership-change approvals at this stage rather than after the application is drafted.

Step 4: Build governance and fit-and-proper readiness

Regulators assess the character, competence and financial soundness of directors, senior officers and significant shareholders. Before applying, confirm your board composition, document relevant experience, and be ready to disclose beneficial ownership in full. Gaps here are a common cause of delay.

Step 5: Assemble the application dossier

The Regulations require a structured set of supporting documents covering the business plan, financial information and capital evidence, governance framework, risk-management policy, AML/CFT/CPF programme, cybersecurity and IT policies, complaints procedure, and, where relevant, custody and business-rule documentation. See our application documents checklist for the full list.

Step 6: Submit and respond to regulator queries

Expect an iterative process. Regulators commonly raise clarifying questions on governance, financial soundness, or specific policy documents before granting a licence. Building in time for at least one round of queries, rather than treating submission as the final step, avoids unrealistic timeline expectations with investors or partners.

Step 7: Plan for post-licensing obligations

A licence is not the end of the compliance exercise. Licensees face ongoing obligations including regulatory reporting, notification of material governance or ownership changes, and periodic compliance reviews. Build these into your operating budget and compliance calendar from day one.

Common mistakes to avoid

• Assuming a token or platform is "unregulated" because it does not resemble a bank or exchange in form.
• Submitting an application before governance and beneficial ownership records are in order.
• Treating AML/CFT policies as boilerplate rather than tailored to the actual business model.
• Underestimating the time needed for regulator queries and clarification rounds.

How Njau & Associates can assist

We advise founders and existing operators on classification, corporate and governance readiness, and preparation of the full application dossier, and we support engagement with the CBK and CMA through to licensing.

What Regulation 6(2) actually requires in the application file

Regulation 6 of the Virtual Asset Service Providers Regulations, 2026 sets out, in detail, what must accompany a licence application. Beyond the summary in our application documents checklist, the regulation is specific that the file must include personal details, qualifications, experience, business interests and occupation of the applicant's directors, senior officers, significant shareholders and beneficial owners; a business plan prepared in accordance with the Third Schedule; a completed fit-and-proper assessment form under the Fourth Schedule; proof of source of funds; and a description of the systems and controls of the proposed virtual asset business.

Regulation 6(2)(f) is unusually specific about the operational policies a regulator expects to see filed with the application itself, not developed afterward: risk management policies, an AML/CFT/CPF policy, a data protection and privacy policy, a cybersecurity and information technology policy, a complaints management policy, a market conduct policy, a consumer protection policy, a conflict of interest policy, and a business continuity and disaster recovery plan. Treat this as a minimum policy suite to have drafted, board-approved and ready before filing, not as documents to produce only if the regulator asks.

Additional filing requirements worth planning for early

• An independent information systems audit, including a vulnerability assessment and penetration test, prepared by a suitably qualified person, must accompany the application. Commissioning this audit typically takes weeks, so it should be scheduled well ahead of your intended filing date.
• Three years of audited financial statements (or, for a newly incorporated applicant, opening financial statements verified by an auditor) must be filed, along with the audited consolidated financial statements of any foreign parent entity for three years, where the applicant is a subsidiary.
• Full disclosure of cross-border operations, affiliates, and regulatory status in other jurisdictions is required regardless of licence category, so groups with international operations should prepare this disclosure comprehensively rather than partially.
• Business rules prepared under Regulation 20 are specifically required for virtual asset exchanges, token issuance platforms, virtual asset offerings and wallet providers, in addition to the general application documents.

The statutory determination timeline

Regulation 6(4) gives the relevant regulatory authority thirty days from receipt of all required documents and information, and completion of due diligence, to determine an application and notify the applicant. In practice, this thirty-day clock runs from when the file is genuinely complete, not from initial submission, so an incomplete filing that triggers requests for further information effectively resets the countdown. The regulatory authority may also require an applicant to participate in an interview to obtain further information about the application.

Licensing more than one activity

Regulation 6(5) allows the regulatory authority to grant a single applicant a licence covering more than one permissible activity, but only where it determines the activities either constitute distinct lines of business with independent risk profiles, infrastructure or operational control, or share common infrastructure, risk profiles or operational features that make combined licensing appropriate. Founders planning a multi-activity platform (for example, a wallet provider that also intends to operate an exchange) should present this analysis proactively in the application rather than leaving the regulator to work it out, and should budget capital under the Regulation 85(6) stacking rule covered in our costs and capital guide.

Realistic application preparation mistakes

• Filing before the required operational policies (AML/CFT/CPF, cybersecurity, business continuity, and the rest of the Regulation 6(2)(f) suite) are actually drafted and board-approved, rather than in outline only.
• Leaving the independent information systems audit and penetration test to be commissioned after the application is otherwise ready, adding weeks of avoidable delay.
• Underestimating the audited financial statement requirement, particularly for newly incorporated applicants who still need auditor-verified opening financial statements.
• Failing to disclose cross-border affiliates and their regulatory status in full, which is a specific, named requirement rather than a general good-practice suggestion.

Preparing a VASP application?

We can review your likely licence category, application dossier and regulatory-readiness gaps before you file.

Key legal & regulatory sources

• Kenya Law — Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025)
• Kenya Law — Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026)
• Central Bank of Kenya and Capital Markets Authority public guidance on VASP licensing

Frequently asked questions

Related insights

The information on this website is general in nature, is not legal advice, and does not create an advocate-client relationship. Figures, fees, capital thresholds and procedural requirements under the Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026 should be confirmed against the current Gazette text and regulator guidance before action is taken. Please contact Njau & Associates Advocates for advice on your specific circumstances.