This checklist organises the areas a Kenyan VASP application generally needs to address, drawn from the structure of the Virtual Asset Service Providers Act, 2025 and the 2026 Regulations. It is a practical planning tool, not a substitute for a specific classification and application review, since the precise requirements differ by licence category.

1. Business activity classification

We have identified every distinct virtual asset activity our business performs
We have not assumed a single licence covers all our activities
We have documented our reasoning against the Act's activity definitions

2. Applicable regulator

We have identified whether CBK, CMA, or both apply to our activities
We have not relied on general shorthand ("payments vs markets") without checking the specific activity

3. Licence category

We have matched each activity to its specific licence category under the First Schedule
We understand which category is primary if we perform more than one

4. Corporate structure

Our corporate vehicle (incorporation or branch registration) is confirmed as appropriate for our licence category
Constitutional documents are finalised and address token or virtual-asset-related rights where relevant

5. Shareholding

Our shareholding structure is documented and current
Any planned pre-licence fundraising is factored into the structure

6. Beneficial ownership

We have mapped ownership down to natural-person beneficial owners
Ownership records are consistent across all corporate documents

7. Board composition

Our board has documented relevant financial services, technology, risk or compliance expertise
Board composition matches the expectations for our specific licence category

8. Senior management

Senior officer roles and reporting lines are documented
CVs and role descriptions are ready for submission

9. Fit-and-proper readiness

Each director and senior officer has completed required declarations
No unresolved integrity, competence or financial-soundness concerns are outstanding

10. Capital

We have confirmed the paid-up capital threshold for our licence category against the current Regulations
Capital is evidenced and, where required, held in the appropriate form

11. Liquidity

We have confirmed any liquid capital requirement applicable to our category
We have a plan for maintaining liquidity on an ongoing basis post-licensing

12. Source of funds

Source-of-funds evidence for capital and major shareholders is documented

13. Business plan

Our business plan describes the product, market and operating model clearly
Financial projections are realistic and internally consistent

14. AML/CFT/CPF

We have a documented enterprise-wide risk assessment
KYC/CDD and enhanced due diligence procedures are drafted and tailored to our business
Sanctions screening is in place

15. Risk management

An enterprise risk-management policy is documented and board-approved

16. Compliance function

A designated compliance officer is in place with appropriate seniority
Board oversight of compliance is documented

17. Customer onboarding

Onboarding flows incorporate identity verification proportionate to risk

18. Transaction monitoring

Monitoring is calibrated to virtual-asset-specific transaction patterns, not just generic rules

19. Technology architecture

System architecture, including key management, is documented

20. Cybersecurity

Cybersecurity policy and access controls are documented
Recent penetration testing or security audit evidence is available

21. Business continuity

A business continuity and disaster recovery plan is documented and tested

22. Custody

Custody architecture and wallet structure are documented
Third-party custody agreements, if any, are finalised

23. Customer asset segregation

Customer assets are segregated from operating assets with clear internal attribution
Reconciliation processes are documented and operating

24. Complaints

A complaints-handling policy and process is documented

25. Consumer protection

Customer terms and risk disclosures are drafted and reviewed

26. Outsourcing

Material outsourcing and vendor arrangements are documented with risk assessments

27. Financial statements / audit

Financial statements or opening financial position statements are prepared

28. Application documentation

Full application dossier assembled against our specific licence category's requirements

29. Regulatory engagement

We have budgeted time for at least one round of regulator queries

30. Post-licensing compliance

A compliance calendar for ongoing reporting obligations is in place

31. Transition considerations

If we were already operating before 4 November 2025, we understand our position under the transition deadline of 4 November 2026
If we are a new entrant or offshore platform, we understand the transition deadline does not apply to us in the same way

This checklist is general in nature, is not legal advice, and does not create an advocate-client relationship. It should not be treated as an exhaustive statement of what any specific licence category requires under the Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026. Requirements should be confirmed against the current Gazette text and regulator guidance, and may be supplemented by subsequent CBK or CMA notices. Please contact Njau & Associates Advocates for advice on your specific circumstances.

Kenya VASP Licensing Readiness Checklist 2026