Kenya VASP Licensing & Compliance Resource Centre
The central hub for licence categories, CBK/CMA jurisdiction, costs, AML and the transition deadline.
Read insight →Custodial virtual asset wallet provision sits among the activities generally associated with Central Bank of Kenya oversight, reflecting its similarity to holding customer funds. The regulatory outcome for a wallet business, however, depends heavily on whether it is genuinely custodial.
The custody question
The key legal question is who controls the private keys, and by extension the assets, at any given moment. A wallet provider that holds, generates or has practical control over customers' private keys, such that it could move customer assets without the customer's independent action, is providing custody. A wallet that merely gives users an interface to manage keys that only they control is not.
Custodial wallet providers
A custodial wallet provider should expect obligations similar in character to those applied to other institutions holding customer funds: segregation of customer assets, reconciliation and record-keeping, capital adequacy, and AML/CFT/CPF controls calibrated to onboarding and transaction monitoring. Because custodial wallets concentrate customer asset risk in one place, regulators are likely to scrutinise operational resilience, key-management security and incident response particularly closely.
Non-custodial wallet technology
A genuinely non-custodial wallet, where the provider never has access to private keys and cannot move customer assets, sits differently under the framework. This does not mean every non-custodial wallet is automatically outside the regulatory perimeter; a business should not assume exemption simply because it labels its product "non-custodial." Where a non-custodial wallet is bundled with other services, such as an integrated exchange or payment feature, those additional functions may bring the combined platform within scope even if the wallet component itself would not be.
Hybrid and semi-custodial models
Multi-signature arrangements, recovery services, and other models that give a provider partial but real control over customer assets sit in a genuinely fact-specific zone. These structures should be assessed individually against the custody definition rather than assumed to fall on either side of the line by default.
Practical steps for wallet businesses
- Document precisely how private keys are generated, stored and controlled in your architecture.
- Assess each product feature (custody, exchange, payment, recovery) separately against the licence categories.
- Do not rely on marketing language such as "non-custodial" as a substitute for a functional legal analysis.
- Where custody is confirmed, build segregation, reconciliation and incident-response capability before scaling customer numbers.
Not sure if your wallet product is custodial?
We assess your key-management architecture against the custody definition before you assume either way.
Request a Wallet Classification ReviewKey legal & regulatory sources
- Kenya Law — Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025)
- Kenya Law — Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026)
- Central Bank of Kenya and Capital Markets Authority public guidance on VASP licensing
Frequently asked questions
Is every crypto wallet app regulated in Kenya?
No. Regulation turns on whether the provider has practical control over customer private keys or assets. A genuinely non-custodial wallet is analysed differently from a custodial one, though bundled features can change that analysis.
Does a hardware wallet manufacturer need a VASP licence?
A manufacturer selling hardware that customers use to control their own keys, with no ongoing custody or service relationship over customer assets, is generally providing technology rather than a regulated custody service. This should still be confirmed against the specific product and business model.
What does 'segregation' of customer assets actually require?
In practice, it means customer assets are held and accounted for separately from the provider's own assets, with clear records showing which assets belong to which customer, so that customer holdings are identifiable and protected independent of the provider's own financial position.
Related insights
Fintech,
Fintech,
Customer Asset Segregation & Custody Rules for VASPs in Kenya
How custodial wallet providers should structure segregation and records.
Read insight →Fintech,
Crypto Payment Processor & Fiat/Crypto Gateway Licensing in Kenya
How payment flows and conversion architecture are analysed under the VASP framework.
Read insight →The information on this website is general in nature, is not legal advice, and does not create an advocate-client relationship. Figures, fees, capital thresholds and procedural requirements under the Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026 should be confirmed against the current Gazette text and regulator guidance before action is taken. Please contact Njau & Associates Advocates for advice on your specific circumstances.