The Virtual Asset Service Providers Act, 2025 is Kenya’s dedicated statutory framework for licensing and supervising virtual asset service providers (VASPs). The Act is Act No. 20 of 2025, was assented to on Oct. 15, 2025, published in the Kenya Gazette on Oct. 21, 2025, and commenced on Nov. 4, 2025. As of July 21, 2026, it should be treated as an in-force national Act, with an implementation caveat: CBK and CMA have said licensing will commence once implementing regulations are issued.
Scope of Kenya’s VASP framework
The Act’s stated object is to create a legal framework to license and regulate activities of VASPs in and from Kenya. It applies to persons offering virtual asset services in Kenya and defines a VASP as a company licensed under the Act to carry on virtual asset services. It excludes certain closed-ecosystem digital representations, digital representations of fiat currency issued by central banks, and NFTs that are not used for payment, investment, or other financial purposes. The Act also states that virtual service tokens are not virtual assets when they are not transferable or exchangeable with third parties.
Regulators and licensing structure
The statute designates the Capital Markets Authority, the Central Bank of Kenya, and any other public body designated by Gazette notice as relevant regulatory authorities. Their functions include licensing VASPs for activities listed in the First Schedule, regulating virtual asset offering promoters, issuing directions or guidance, taking enforcement action for non-compliance, supporting financial stability, and sharing information with supervisory, competent, and investigating authorities.
Licensing is activity-based. The First Schedule assigns virtual asset wallet providers, virtual asset payment processors, and stablecoin issuance to the Central Bank of Kenya. It assigns virtual asset exchanges, trading/clearing/settlement platforms, brokers, investment advisers, managers, offering providers, tokenization and token issuance platforms to the Capital Markets Authority.
Core obligations for VASPs
The Act prohibits a person from carrying on or holding itself out as carrying on virtual asset services in or from Kenya unless licensed by the relevant authority. Applications are assessed against eligibility, skills and experience, financial obligations, cybersecurity, consumer protection, data protection, fit-and-proper standards, physical premises or approved data solutions, and public-interest considerations. Licences expire on Dec. 31 of the year of issue unless renewed under the implementing framework.
- Governance: licensees must satisfy fit-and-proper requirements for directors, senior officers, beneficial owners, and significant shareholders.
- Local presence: a VASP must maintain a physical office in Kenya where its business activities are carried out.
- Cybersecurity and reporting: licensees must maintain cybersecurity measures and prepare annual audited financial statements.
- Customer assets: licensees must hold sufficient customer assets, meet prescribed financial requirements, segregate client assets, and keep client assets away from licensee creditor claims.
AML/CFT, offerings and enforcement
The Act gives the relevant regulator AML/CFT/CPF supervision powers over VASPs, including inspections, surveillance, shareholder and officer vetting, information-production powers, sanctions, guidance, cooperation and information sharing. It also restricts virtual asset offerings: a person may not issue or promote a virtual asset offering in or from Kenya, or seek trading-platform admission, unless the issuance is approved under the Act or another relevant law and the authority has issued a written no-objection where required.
Regulators may inspect, investigate, require documents, and use enforcement tools, while the Cabinet Secretary may make implementing regulations covering application forms, fees, business standards, advertising, prudential rules, cybersecurity, custody, capital, insurance, freezing and seizure orders, stablecoin issuance, tokenization, ICOs, periodic returns and penalties.
Status and implementation timeline
Existing providers were given one year from commencement to comply, making Nov. 4, 2026 the key transitional compliance date if no later instrument changes the implementation path. On Nov. 18, 2025, CBK and CMA said no VASPs had yet been licensed under the Act and that licensing would begin upon issuance of implementing regulations. In March 2026, the National Treasury, working through a multi-agency task force with CBK and CMA, published draft Virtual Asset Service Providers Regulations, 2026 for public comment by Apr. 10, 2026. Editors should verify whether those regulations have been finalized before publishing or updating this profile.