VASP Licensing & Regulatory Compliance Lawyers Kenya

Overview

The Virtual Asset Service Providers Act, 2025 (Act No. 20 of 2025) commenced on 4 November 2025 and establishes a licensing and supervisory framework for virtual asset service providers operating in or from Kenya. The Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), gazetted on 22 July 2026, supply the operating detail: application requirements, governance and fit-and-proper standards, capital and liquidity expectations, custody and asset-segregation rules, cybersecurity and systems controls, and ongoing reporting obligations.

For a business already operating, or planning to operate, an exchange, wallet, payment, brokerage, advisory, asset management, tokenisation or virtual asset offering model touching Kenya, the practical question is no longer whether the sector is regulated. It is which licence category applies, which regulator has jurisdiction, and what a compliant application file looks like.

The dual regulatory model: CBK and CMA

The Act divides supervisory responsibility between the Central Bank of Kenya and the Capital Markets Authority. Rather than a simple "payments vs markets" rule of thumb, the Act allocates supervision by specific defined activity, so each activity a business performs should be checked individually against the current First Schedule; see our CBK vs CMA guide for a category-by-category breakdown. A business that combines several functions, for example a platform that both custodies assets and operates a trading venue, may need to consider its position under more than one regulator.

Not sure which licence applies? Classification depends on what the platform actually does, how customer funds and assets move, and which services are genuinely provided, not on how the product is marketed or described. We review the business model, customer journey and asset flows and map them against the licence categories in the Act and Regulations.

Request a licence classification review

Who this service is for

Crypto exchanges and trading platforms
Custodial wallet providers and wallet infrastructure businesses
Virtual asset payment processors and fiat/crypto gateways
Brokers and investment intermediaries
Virtual asset managers and advisers
Stablecoin issuers
Tokenisation and real-world-asset platforms
Token issuance platforms and virtual asset offering providers
Financial institutions exploring virtual asset services
Offshore platforms serving, or considering serving, Kenyan customers
Investors and acquirers conducting regulatory due diligence on a virtual asset business

How we can assist

Regulatory issue	Who it affects	How we can assist
Regulatory classification	Any business unsure which VASP activity or regulator applies	Identifying the relevant regulated activity or activities and the applicable regulator, CBK, CMA, or both
Licence application preparation	Applicants ready to file	Preparing the application dossier, business plan, corporate information and supporting documentation
Governance & fit-and-proper readiness	Boards, senior officers and significant shareholders	Advising on directors, senior officers, beneficial ownership and governance structure against regulatory expectations
Custody & wallet compliance	Custodial wallet providers and exchanges	Structuring customer asset arrangements, segregation and custody documentation
Crypto/fiat payment & gateway structuring	Payment processors and gateway operators	Mapping payment architecture and conversion flows against the applicable licensing analysis
Tokenisation & real-world assets	Tokenisation platforms and asset owners	Structuring tokenisation arrangements, underlying rights and offering documentation
Virtual asset offerings	ICO, stablecoin and token issuance platforms	Advising on token issuance, offering documentation and disclosure requirements
AML/CFT/CPF	All licensed VASPs	Enterprise risk assessment, KYC/CDD policies, enhanced due diligence and suspicious transaction procedures
Cybersecurity & technology controls	All licensed VASPs, especially exchanges and custodians	Policies, outsourcing arrangements, systems governance and incident response documentation
Consumer protection & disclosure	Businesses onboarding retail customers	Customer terms, risk disclosures and complaints-handling documentation
Continuing regulatory compliance	Licensed VASPs post-grant	Regulatory reporting, licence conditions, governance changes and periodic reviews

Which Kenyan VASP licence may apply to your business?

This is an educational starting point, not an automated legal opinion. Consider the questions below, then speak to us for a proper classification review, since more than one answer can be "yes" for a single business.

Do you custody customers' virtual assets or private keys?
Do you operate a trading venue for virtual assets?
Do you facilitate virtual asset payments or crypto-fiat conversion?
Do you execute virtual asset transactions on behalf of clients?
Do you provide investment advice on virtual assets?
Do you exercise investment discretion over clients' virtual assets?
Are you issuing a virtual asset, such as a token or coin?
Are you tokenising a real-world asset, such as property or a fund interest?
Are you operating a token issuance platform for third parties?
Are you issuing a stable-value virtual asset (a stablecoin)?

A "yes" to more than one of these questions usually means more than one activity, and possibly more than one regulator, needs to be considered together, not a single generic licence.

Get a regulatory classification assessment

What does a VASP licence application file need?

The Regulations require a structured application file. This is a practical starting point, not an exhaustive statement of what your specific licence category requires:

Certificate of incorporation and constitutional documents, shareholding structure and beneficial ownership records
Fit-and-proper documentation for directors and senior management
Business plan and financial information, including evidence of capital and source of funds
Governance framework, risk-management policy and AML/CFT/CPF programme
Cybersecurity and IT policies, business continuity and outsourcing arrangements
Complaints-handling policy and customer disclosures
Custody and asset-segregation arrangements, platform rules or offering documentation, where relevant to the licence category

See our application documents checklist for the full breakdown by category.

Request an application readiness review

Why businesses engage Njau & Associates for virtual asset regulation

Integrated corporate and fintech advice. Licensing, corporate structuring and commercial documentation handled together, not as separate workstreams.
Fluency in the underlying business models. We understand how exchanges, wallets, payment rails and tokenisation platforms actually move money and assets, not just the licence categories on paper.
Connecting regulatory requirements to technical reality. We translate governance, custody and AML expectations into practical requirements your product and operations teams can implement.
Partner-led advice. Direct access to the advocate handling your matter throughout classification, application and ongoing compliance.
Cross-border perspective. Experience advising both Kenyan-incorporated businesses and offshore platforms assessing their exposure to the Kenyan framework.

Engagement roadmap

Our typical engagement runs in four stages, calibrated to how far along your business already is:

Regulatory classification & gap assessment. We analyse your activities, corporate structure, customer journey, asset and payment flows, and identify the applicable regulator and licence category or categories.
Corporate, governance & compliance readiness. We help prepare or remediate corporate structure, shareholding and beneficial ownership records, board and senior management documentation, and the governance framework a regulator will expect to see.
Application dossier & regulatory documentation. We support preparation of the application forms, business plan, AML/CFT/CPF framework, risk framework, cybersecurity and IT policies, and other supporting evidence.
Regulatory engagement & continuing compliance. We support responses to regulator queries, implementation of licence conditions, and ongoing reporting and compliance review once licensed.

Discuss your VASP application

Related insights

Fintech,

8 min read

Real-World Asset Tokenisation in Kenya: Legal Questions Founders Should Resolve

Before tokenising property or other assets, founders should resolve a set of foundational legal questions. Here is a practical map.

Read insight →

Fintech,

10 min read

The Legal & Regulatory Framework for Capital Raising via Digital Assets in Kenya: A Founder's Guide

CMA and CBK jurisdiction, the regulatory sandbox, SAFTs, SPVs and AML compliance for token-based capital raises.

Read insight →

Frequently asked questions

Does my crypto business need a VASP licence in Kenya?

If your business carries on a regulated virtual asset activity in or from Kenya, such as operating an exchange, custody, payment processing, brokerage, advisory, asset management, or a token or stablecoin offering, it will generally need to be licensed under the Act and the 2026 Regulations. The correct classification depends on what the business actually does, not what it calls itself.

Is VASP licensing handled by the CBK or the CMA?

Both. The Act creates a dual-regulator model, with the Central Bank of Kenya and the Capital Markets Authority each responsible for defined categories of virtual asset activity. A business operating more than one regulated function may need to engage with both regulators.

What is the significance of 4 November 2026?

Section 47 of the Act gave persons already providing virtual asset services at commencement one year, running from 4 November 2025, to regularise their position. That transitional window closes on 4 November 2026. It applies to existing operators; new entrants and offshore platforms should assess their own position under the Act and Regulations before commencing or continuing to serve Kenyan customers.

Do offshore crypto companies serving Kenyan customers need a Kenyan licence?

The framework is understood to extend to providers targeting Kenyan customers or deriving business from Kenya even without a local physical presence. Whether a specific offshore platform falls within scope depends on factors such as its customer base, marketing, currency support and local partnerships, and should be assessed on the facts.

What does a licence application require?

The Regulations set out detailed requirements covering corporate and ownership information, directors and senior officer fit-and-proper documentation, a business plan, financial and capital information, governance and risk-management frameworks, AML/CFT/CPF policies, cybersecurity and systems documentation, and custody arrangements where relevant. The precise mix depends on the licence category sought.

Can Njau & Associates prepare a full VASP licence application?

Yes. We assist with regulatory classification, corporate and governance readiness, and preparation of the application dossier and supporting documentation, and we support clients through regulator engagement and subsequent compliance.

The information on this website is general in nature, is not legal advice, and does not create an advocate-client relationship. Figures, fees, capital thresholds and procedural requirements under the Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026 should be confirmed against the current Gazette text and regulator guidance before action is taken, as these may be updated or clarified over time. Please contact Njau & Associates Advocates for advice on your specific circumstances.

VASP Licensing & Regulatory Compliance in Kenya

Existing virtual asset business in Kenya? The transition period requires attention.