Kenya Crypto Licence Explained: Everything You Need to Know Before Launching a Virtual Asset Business

A Practical Guide to Kenya VASP Licensing, CBK and CMA Regulation, Capital Requirements, Application Costs and Compliance

A founder develops a mobile application that allows customers in Kenya to buy USDT using Kenyan shillings.

The customer creates an account, completes identity verification, deposits funds and receives stablecoins in a wallet displayed inside the application. The customer can then transfer the stablecoins, exchange them for Bitcoin or use them to pay participating merchants.

To the founder, it is one product.

To the regulator, it may be several businesses operating through one interface.

The platform could be:

• processing virtual asset payments;
• providing custodial wallet services;
• facilitating virtual asset exchange;
• arranging transfers; and
• earning transaction-based income from Kenyan consumers.

That distinction matters because Kenya does not issue one unlimited licence covering every form of crypto activity.

The correct Kenya crypto licence depends on what the business actually does, who controls customer assets, how transactions are executed, where income is generated and which risks the company assumes.

Kenya’s regulatory framework is now built around the Virtual Asset Service Providers Act, 2025, together with the Virtual Asset Service Providers Regulations, 2026. The Act came into force on 4 November 2025, while the final Regulations were published as Legal Notice No. 134 on 22 July 2026. Together, they establish a detailed framework for licensing and supervising virtual asset businesses operating in or from Kenya.

This guide explains:

• who needs a crypto licence in Kenya;
• which regulator is responsible;
• the available licence categories;
• whether foreign companies are covered;
• capital and liquidity requirements;
• application fees and real project costs;
• documents required for a Kenya VASP licence;
• AML, cybersecurity and consumer-protection obligations;
• the licensing process and timeline;
• common application mistakes; and
• what licensed businesses must do after approval.

1. What Is a Kenya Crypto Licence?

A Kenya crypto licence is a regulatory authorisation permitting an eligible company to conduct one or more specified virtual asset services in or from Kenya.

The legislation generally uses the term Virtual Asset Service Provider licence, commonly shortened to VASP licence.

A VASP licence is not equivalent to:

• ordinary company registration;
• a business permit;
• a technology licence;
• registration for tax purposes;
• approval from a commercial bank;
• membership of a blockchain association; or
• a crypto licence issued in another country.

Company incorporation creates the legal entity.

The Kenya VASP licence authorises that entity to carry on specified regulated virtual asset activities.

This means a company may be legally incorporated in Kenya but still be prohibited from launching its crypto exchange, hosted wallet, OTC brokerage, payment gateway, tokenisation platform or stablecoin until the appropriate licence has been granted.

The Act’s main object is to establish a legislative framework for licensing and regulating virtual asset service providers operating in and from Kenya. It defines a VASP as a company licensed under the Act to conduct virtual asset services.

2. Is Cryptocurrency Legal in Kenya?

Kenya has not adopted a general prohibition on cryptocurrency.

Instead, it has introduced an activity-based regulatory regime.

Virtual assets may be used, transferred, traded or developed within the limits of applicable law. However, a person must not provide a regulated virtual asset service without the relevant licence.

This distinction is important.

The law does not treat all personal ownership or use of crypto as a licensed business. An individual buying Bitcoin for personal investment is not the same as a company operating an exchange through which thousands of customers buy and sell virtual assets.

Similarly:

• holding crypto personally is different from safeguarding it for customers;
• building blockchain software is different from operating a trading platform;
• giving general education is different from personalised investment advice;
• selling a digital collectible is different from issuing an investment token; and
• Accepting a cryptocurrency payment personally is different from operating a commercial crypto payment processor.

The licensing requirement arises when a company conducts one or more regulated virtual asset services as a business.

3. Who Regulates Crypto Businesses in Kenya?

Kenya uses a dual-regulator structure.

The principal regulators are:

1. the Central Bank of Kenya, commonly referred to as CBK; and
2. the Capital Markets Authority, commonly referred to as CMA.

The correct regulator depends on the activity being conducted.

Central Bank of Kenya

CBK regulates:

• virtual asset wallet providers;
• virtual asset payment processors; and
• stablecoin issuers.

These activities are closely connected to custody, payments, settlement, reserve assets and financial stability.

Capital Markets Authority

CMA regulates:

• virtual asset exchanges;
• virtual asset brokers;
• virtual asset investment advisers;
• virtual asset managers;
• initial coin offering providers;
• virtual asset tokenisation providers; and
• token issuance platforms.

These activities are more closely connected to trading, investment, market conduct, portfolio management and capital raising.

The legislation assigns the regulators responsibility for licensing, supervision, monitoring, enforcement and oversight of the relevant VASP categories.

Can one business need both CBK and CMA approval?

Yes.

A multi-product platform may conduct activities falling within both regulatory mandates.

For example, an application may:

• hold customer private keys;
• allow customers to exchange virtual assets;
• process merchant payments; and
• facilitate token subscriptions.

The custody and payment elements may fall under CBK, while exchange and token issuance activities may fall under CMA.

The 2026 Regulations allow an applicant to seek authorisation for more than one permissible activity where the regulator is satisfied that the activities have appropriate infrastructure, controls and risk separation.

However, the applicant should not assume that obtaining one permission automatically covers every feature offered through the platform.

4. Who Needs a Crypto Licence in Kenya?

A Kenya VASP licence may be required where a company commercially provides any regulated virtual asset service in or from Kenya.

The practical test is not based only on what the business calls itself.

The regulator will consider the substance of the activity.

A company may require a Kenya crypto licence where it:

• enables customers to buy or sell virtual assets;
• matches crypto buyers and sellers;
• executes virtual asset orders;
• operates an OTC crypto desk;
• holds private keys for customers;
• provides hosted wallets;
• receives or transfers customer virtual assets;
• processes merchant crypto payments;
• provides fiat-to-crypto or crypto-to-fiat services;
• manages virtual asset portfolios;
• gives personalised crypto investment advice;
• issues tokens to raise funds;
• tokenises real-world assets;
• operates a token launchpad;
• issues a stablecoin; or
• derives income from providing such services to Kenyan customers.

The analysis must follow the entire customer journey.

A founder should be able to explain:

1. who receives the customer’s money;
2. who controls the virtual assets;
3. who holds the private keys;
4. who determines the transaction price;
5. who executes the trade;
6. who settles the transaction;
7. which entity contracts with the customer; and
8. which entity earns the fee, commission or spread.

These questions often reveal that a business performs more regulated functions than initially expected.

5. Kenya Crypto Licence Categories Explained

5.1 Virtual Asset Exchange Licence

A virtual asset exchange facilitates trading or exchange between:

• virtual assets and fiat currency;
• one virtual asset and another virtual asset; or
• buyers and sellers of virtual assets.

An exchange may operate:

• a central order book;
• a request-for-quotation model;
• a peer-to-peer marketplace;
• an automated trading engine;
• a conversion platform; or
• another system through which customer orders are executed.

The Act describes a virtual asset trading platform as a digital platform that facilitates virtual asset trading for a fee, commission or other benefit and either controls assets for customers or purchases assets from matched sellers for resale to buyers.

A company seeking a crypto exchange licence in Kenya should expect scrutiny of:

• listing and delisting standards;
• market surveillance;
• liquidity arrangements;
• order execution;
• settlement;
• conflicts of interest;
• custody;
• cyber resilience;
• pricing;
• market manipulation;
• insider dealing;
• customer disclosures; and
• complaints handling.

An exchange licence does not necessarily cover custodial wallet or payment-processing activity. The complete operating model must be assessed.

5.2 Virtual Asset Broker Licence

A virtual asset broker arranges or executes transactions for customers.

A typical broker may:

• receive customer instructions;
• source assets from liquidity providers;
• arrange block trades;
• introduce buyers and sellers;
• execute customer orders through third-party platforms;
• operate an OTC desk;
• negotiate transaction terms; or
• earn a spread or commission.

A broker differs from an exchange because it may not operate a public marketplace or order book.

However, an OTC business is not automatically unregulated.

Suppose a customer asks a Kenyan company to purchase KSh 20 million worth of USDT. The company obtains a quotation from an international liquidity provider, adds a margin and completes the trade for the customer.

That arrangement may amount to regulated virtual asset brokerage, even where the company describes itself as a “facilitator” or “liquidity introducer”.

The regulator will examine the company’s actual involvement, contractual role and revenue model.

5.3 Virtual Asset Wallet Provider Licence

A wallet provider may require a licence where it controls or manages customer private keys.

The Act defines a custodial wallet as a wallet in which a third party holds and manages the private keys for proof of ownership and transaction facilitation.

A regulated wallet service may include:

• retail hosted wallets;
• institutional custody;
• hot-wallet services;
• cold-storage services;
• multi-signature custody;
• deposit and withdrawal processing;
• transaction authorisation;
• wallet recovery; and
• safeguarding of customer virtual assets.

The key regulatory question is control.

Where customers alone possess and control their private keys, the service may be non-custodial. But the provider should examine whether it can:

• recover the wallet;
• pause transactions;
• approve withdrawals;
• alter smart-contract controls;
• reconstruct keys;
• access customer assets; or
• exercise administrative control over the wallet.

A service marketed as non-custodial may still raise custody issues where the provider retains meaningful technical control.

Wallet providers are regulated by CBK.

5.4 Virtual Asset Payment Processor Licence

A virtual asset payment processor arranges transactions involving virtual assets and fiat currency or transactions between virtual assets.

Possible business models include:

• merchant crypto-payment gateways;
• crypto checkout services;
• stablecoin payment systems;
• crypto remittance infrastructure;
• fiat-to-crypto on-ramp services;
• crypto-to-fiat off-ramp services;
• payment collection;
• payment routing; and
• settlement of crypto receipts into Kenyan shillings.

For example, a Kenyan online retailer may wish to accept USDT.

A payment processor receives the customer’s USDT, converts it through a liquidity partner and pays the merchant in Kenyan shillings.

The payment processor may still be regulated even where it outsources the underlying conversion.

The legal assessment will consider:

• who contracts with the merchant;
• who receives payment instructions;
• who routes the transaction;
• who bears failed-settlement risk;
• who handles refunds;
• who converts the assets; and
• who earns the processing fee.

CBK supervises virtual asset payment processors.

5.5 Virtual Asset Investment Adviser Licence

A company may require a virtual asset investment adviser licence where it advises clients about purchasing, holding, selling or allocating virtual assets.

Regulated advice may include:

• personalised token recommendations;
• crypto portfolio advice;
• suitability assessments;
• investment research tailored to a client;
• recommendations concerning ICOs;
• advice on tokenised investment products; and
• advice relating to crypto investment strategies.

General market commentary or educational content may fall outside regulated advice, depending on the circumstances.

However, a disclaimer stating “this is not financial advice” does not change the legal character of a service that provides individualised recommendations for payment.

The regulator will look at substance, not disclaimers alone.

5.6 Virtual Asset Manager Licence

A virtual asset manager exercises discretion over client assets or portfolios.

The customer gives the manager authority to decide:

• which assets to buy;
• when to trade;
• how much to invest;
• when to rebalance;
• when to realise profits or losses; and
• how to execute the agreed strategy.

Potential models include:

• managed crypto accounts;
• discretionary digital-asset portfolios;
• institutional crypto mandates;
• algorithmic portfolio management; and
• certain crypto fund structures.

Depending on its structure, the arrangement may also trigger securities, fund, collective investment or custody requirements.

Virtual asset managers are regulated by CMA.

5.7 Initial Coin Offering Provider

An initial coin offering provider issues virtual assets as a means of raising funds.

The regulatory framework addresses:

• approval to issue an ICO;
• promoter approval;
• approval of trading platforms;
• white-paper publication;
• advertising periods;
• modification of the white paper;
• extension of an issuance; and
• changes to promoters.

The final Regulations require regulatory approval and detailed disclosures before an ICO is offered to the public.

Calling a token a “utility token” does not automatically place it outside regulation.

Its legal status depends on:

• the rights attached to it;
• its transferability;
• how funds are raised;
• how it is marketed;
• whether purchasers expect a return;
• whether it represents an asset or claim; and
• whether it is admitted to trading.

5.8 Tokenisation Provider Licence

Tokenisation converts rights in real-world assets into digital tokens recorded on distributed ledger technology.

Assets that may potentially be tokenised include:

• real estate;
• commodities;
• precious metals;
• receivables;
• debt instruments;
• intellectual property;
• income streams;
• art; and
• contractual rights.

A tokenisation licence in Kenya does not eliminate the need to comply with laws governing the underlying asset.

For example, tokenising a building may engage:

• land law;
• property registration;
• company law;
• securities regulation;
• collective investment rules;
• custody;
• valuation;
• tax;
• insolvency; and
• investor-protection requirements.

The 2026 Regulations contain specific rules governing applications for tokenisation licences, issuance of tokenised real-world assets, white papers and admission of tokenised assets to trading.

5.9 Token Issuance Platform Licence

A token issuance platform provides infrastructure through which other businesses or project owners can issue, offer or distribute tokens.

Examples include:

• crypto launchpads;
• token subscription portals;
• digital issuance platforms;
• token-offering marketplaces; and
• infrastructure supporting primary token sales.

The platform may not be the issuer, but it can still play a critical role in:

• reviewing projects;
• onboarding investors;
• processing subscriptions;
• publishing disclosures;
• distributing tokens;
• handling customer money; and
• facilitating admission to trading.

This role can create significant gatekeeping and consumer-protection responsibilities.

5.10 Stablecoin Issuer Licence

A stablecoin is a virtual asset designed to maintain a stable value relative to one or more reserve assets, such as:

• fiat currency;
• commodities;
• other virtual assets; or
• a basket of assets.

A company seeking a stablecoin licence in Kenya should expect one of the most demanding VASP authorisation processes.

The final Regulations address:

• stablecoin licence applications;
• stablecoin white papers;
• public offers;
• issuance and redemption;
• reserve assets;
• reserve custody;
• investment of reserve funds;
• conflicts of interest;
• continuing disclosures;
• audits;
• reporting;
• marketing; and
• suspension or delisting.

A stablecoin issuer must be able to demonstrate that its stability and redemption promises are supported by credible financial, operational and legal arrangements.

CBK regulates stablecoin issuance.

6. Does an Offshore Crypto Company Need a Kenya Licence?

Potentially, yes.

The territorial reach of the final Regulations is deliberately broad.

They apply to persons offering virtual asset services in or from Kenya.

A person may be considered to operate in or from Kenya where that person:

• actively solicits or targets local consumers; or
• derives economic benefit or income from Kenya,

regardless of whether the person has a physical presence in Kenya.

This means a foreign exchange cannot assume it is outside Kenyan regulation simply because its:

• company is incorporated abroad;
• servers are outside Kenya;
• custody provider is overseas;
• management team works remotely; or
• contracts are governed by foreign law.

Factors indicating Kenyan market targeting

A foreign company may be treated as targeting Kenyan customers where it:

• accepts Kenyan residents;
• supports Kenyan shillings;
• uses Kenya-specific marketing;
• employs Kenyan agents or affiliates;
• works with Kenyan influencers;
• offers local payment methods;
• runs Kenya-focused promotions;
• partners with Kenyan merchants;
• maintains local customer support; or
• earns fees from Kenyan transactions.

An overseas crypto licence may demonstrate regulatory history and institutional maturity, but it does not replace the need for Kenyan authorisation.

7. Are Any Crypto or Blockchain Activities Exempt?

Yes, but the exemptions are limited and function-specific.

Closed ecosystems

The Act excludes certain digital representations of value operating solely within a closed ecosystem.

To fall within the exclusion, the asset must generally be:

• non-transferable outside the ecosystem;
• non-exchangeable for external goods, services or discounts;
• non-tradeable outside the ecosystem;
• usable only for purposes defined by the issuer; and
• non-exchangeable for fiat currency or virtual assets.

A basic loyalty point may qualify.

However, allowing it to be traded, redeemed externally or transferred between unrelated persons may undermine the exclusion.

Virtual service tokens

A virtual service token is not treated as a virtual asset where it is non-transferable and non-exchangeable with third parties and its sole function is to provide access to a service or function.

Again, the asset’s actual design matters more than its label.

Certain NFTs

An NFT may fall outside the VASP framework where it is not used for:

• payment;
• investment;
• another financial purpose; or
• representation of a financial asset.

A unique digital artwork may be outside the regime.

A fractional NFT representing ownership in rental property, revenue rights or investment returns may require a different analysis.

Central bank digital currencies

Digital representations of fiat currency issued by CBK or another jurisdiction are excluded.

These exclusions appear in section 4 of the Act.

A business should obtain a formal regulatory assessment before relying on an exclusion, particularly where the token has mixed functions.

8. Who Can Apply for a Kenya VASP Licence?

An applicant must generally be:

• a company limited by shares incorporated under Kenya’s Companies Act; or
• a foreign company limited by shares registered under the Companies Act.

The applicant must have a transparent corporate structure.

The regulator will expect clear information concerning:

• directors;
• senior officers;
• significant shareholders;
• beneficial owners;
• group companies;
• parent entities;
• affiliates;
• controlling persons; and
• sources of capital.

A significant shareholder is generally a person holding, directly or indirectly, more than 10% of the company’s share capital.

Complex international structures are not automatically prohibited, but they must be explainable.

The regulator should be able to determine:

• who owns the applicant;
• who controls it;
• who funded it;
• where strategic decisions are made;
• which entity owns the technology;
• which entities provide services to the applicant; and
• whether any person poses a regulatory, financial-crime or reputational risk.

9. Kenya VASP Capital Requirements

Capital requirements vary materially by licence category.

Paid-up capital is the issued and fully paid ordinary share capital contributed by the shareholders.

It is not a government fee.

The money remains within the applicant company, subject to regulatory and operational requirements.

Capital is not the same as the operating budget

A company should not assume that it can inject the statutory minimum and then use most of it to fund the launch.

The business must remain adequately capitalised while paying for:

• staff;
• technology;
• premises;
• insurance;
• compliance systems;
• legal support;
• cybersecurity;
• auditors;
• marketing; and
• ordinary operating expenses.

Some licence categories are also subject to separate liquid-capital requirements.

The applicant should therefore calculate:

required regulatory capital + liquid-capital buffer + pre-launch expenditure + operating runway.

A company that technically meets the minimum capital threshold but cannot finance its first year of operations may not appear financially sustainable.

10. Kenya Crypto Licence Fees

The final Regulations prescribe application and initial licence fees for each category.

The application fee is generally forfeited where an application is withdrawn.

What does a Kenya crypto licence really cost?

The official regulatory fees are only one part of the project.

The broader Kenya crypto licence cost may include:

• company incorporation;
• regulatory advisory;
• business-plan preparation;
• policy development;
• financial modelling;
• compliance recruitment;
• MLRO and senior management costs;
• KYC systems;
• sanctions screening;
• blockchain analytics;
• Travel Rule technology;
• platform development;
• cybersecurity audits;
• vulnerability assessments;
• penetration testing;
• external audit;
• office premises;
• insurance;
• regulatory capital; and
• post-licensing compliance.

The real financial question is not simply:

“What is the application fee?”

It is:

“What will it cost to build and maintain a business capable of being licensed?”

11. Kenya Crypto Licence Requirements

The licence application is extensive.

The final Regulations require an applicant to submit information and evidence covering the company, its owners, management, finances, systems, technology and operations.

The application package includes:

• details of directors, senior officers, significant shareholders and beneficial owners;
• qualifications, experience, occupations and business interests;
• a regulatory business plan;
• fit-and-proper forms;
• proof of source of funds;
• systems and controls;
• operational policies;
• material contracts and oversight arrangements;
• evidence of paid-up and liquid capital;
• audited or opening financial statements;
• human and technology resources;
• an independent information systems audit;
• vulnerability-assessment and penetration-test reports;
• cross-border regulatory disclosures;
• business rules for certain licence categories;
• market-integrity systems;
• proposed classes of virtual assets;
• principal office and website details;
• incorporation records;
• current director and shareholder records;
• beneficial ownership records; and
• proof of payment of the application fee.

The regulator may also require the applicant and relevant personnel to attend interviews.

11.1 The Regulatory Business Plan

The business plan should explain exactly how the proposed virtual asset business will operate.

It should cover:

• the applicant’s background;
• group and ownership structure;
• proposed licensed activities;
• products and services;
• target market;
• customer types;
• customer onboarding;
• geographic reach;
• transaction flows;
• custody;
• settlement;
• pricing and revenue;
• technology;
• outsourcing;
• governance;
• management;
• AML controls;
• cybersecurity;
• consumer protection;
• risk management;
• capital;
• liquidity;
• financial forecasts; and
• implementation timeline.

A regulatory business plan is not a promotional presentation.

It must identify risks and demonstrate how those risks will be controlled.

11.2 Fit-and-Proper Assessment

The regulator will assess whether key persons are suitable to own, manage or control a licensed VASP.

The assessment may cover:

• honesty;
• integrity;
• reputation;
• competence;
• qualifications;
• relevant experience;
• financial soundness;
• criminal history;
• regulatory history;
• insolvency;
• conflicts of interest; and
• capacity to perform the relevant role.

The Act requires fit-and-proper assessment of directors, senior officers and beneficial owners. It also directs the regulator to consider their suitability when deciding whether to grant the licence.

The applicant should not appoint senior personnel merely to satisfy a document checklist.

Each officer should understand and genuinely perform their function.

11.3 Source of Funds

The applicant must prove the lawful origin of the money used to capitalise and operate the business.

Evidence may include:

• bank statements;
• audited accounts;
• employment income;
• business income;
• dividends;
• investment proceeds;
• asset-sale agreements;
• loan documents;
• tax records; and
• wallet transaction histories where funds originated in virtual assets.

The trail should explain how funds moved from their original source into the applicant.

Unexplained deposits, nominee arrangements and circular transfers may create serious concerns.

11.4 Human Resources

The applicant must demonstrate that it has sufficient qualified personnel.

The team may include:

• directors;
• chief executive officer;
• compliance officer;
• money laundering reporting officer;
• finance officer;
• risk officer;
• cybersecurity lead;
• technology personnel;
• customer-support staff;
• operations personnel; and
• internal audit.

The exact structure will depend on the size and complexity of the business.

A startup does not necessarily need the same headcount as an international exchange. It must, however, show that its resources are proportionate to its risks and projected scale.

12. AML, KYC and Travel Rule Obligations

AML/CFT/CPF compliance is a central part of the Kenya VASP framework.

A licensed business should have effective systems for:

• customer identification;
• identity verification;
• beneficial ownership;
• sanctions screening;
• politically exposed person screening;
• customer risk classification;
• source-of-funds checks;
• source-of-wealth checks;
• wallet screening;
• blockchain analytics;
• transaction monitoring;
• enhanced due diligence;
• suspicious transaction reporting;
• record keeping;
• staff training; and
• Travel Rule compliance.

Crypto-related AML controls must address risks that may not arise in traditional financial services.

These include:

• pseudonymous wallet addresses;
• mixers and tumblers;
• stolen virtual assets;
• darknet exposure;
• high-risk exchanges;
• sanctioned addresses;
• cross-chain bridging;
• decentralised protocols;
• privacy-enhancing assets; and
• rapid movement of value across jurisdictions.

A generic AML policy copied from a conventional business may not be adequate.

The policy should reflect:

• the company’s customer types;
• supported assets;
• transaction limits;
• geographic exposure;
• wallet model;
• payment channels;
• liquidity providers; and
• blockchain-analytics systems.

13. Technology and Cybersecurity

A Kenya VASP applicant must demonstrate that its technology is secure, resilient and suitable for the proposed business.

The final Regulations require an independent information systems audit, including:

• a vulnerability assessment; and
• a penetration test.

The cybersecurity framework should address:

• system architecture;
• access control;
• identity and authentication;
• encryption;
• wallet security;
• key management;
• logging;
• transaction monitoring;
• cloud infrastructure;
• backup;
• incident response;
• disaster recovery;
• third-party access;
• data protection; and
• cyber-risk reporting.

The Regulations also impose continuing requirements concerning cybersecurity strategy, systems and controls, cybersecurity audits and reporting of cybersecurity risks.

Can a company apply before its platform is complete?

A platform does not necessarily need to be fully commercialised.

However, it should be sufficiently developed to allow:

• meaningful security testing;
• system demonstrations;
• review of transaction flows;
• validation of access controls;
• assessment of wallet arrangements; and
• verification of compliance integrations.

Applying with only a concept deck or a visual prototype may leave the applicant unable to prove that the proposed system is secure and operationally credible.

14. Consumer Protection and Safeguarding

The final Regulations contain extensive rules concerning the safeguarding and management of consumer assets.

A licensed VASP must address matters such as:

• customer agreements;
• protection of customer assets;
• segregation;
• safekeeping;
• systems and controls;
• protection from third-party claims;
• records and accounts;
• complaints;
• customer care; and
• consumer understanding of risk.

The customer should clearly understand:

• which entity provides the service;
• whether customer assets are held by the VASP or a third party;
• whether assets are pooled;
• where assets are held;
• what fees apply;
• when transactions become final;
• what risks arise;
• what happens during system failure;
• what happens if a custodian becomes insolvent;
• how withdrawals are processed; and
• how complaints are resolved.

The firm should be able to reconcile customer balances and prove ownership of assets it holds on behalf of customers.

15. Market Conduct and Advertising

A crypto business cannot treat marketing as separate from compliance.

The Regulations establish rules governing:

• advertising authorisation;
• advertisement content;
• performance information;
• fees and commissions;
• risk warnings;
• internet advertising;
• third-party marketers;
• prohibited marketing practices; and
• record keeping.

They also prohibit or regulate conduct including:

• insider dealing;
• market manipulation;
• false trading;
• market rigging;
• fraudulent inducement;
• misleading statements;
• front-running;
• churning; and
• cold calling.

Marketing claims should therefore be:

• clear;
• fair;
• accurate;
• balanced;
• properly qualified; and
• not misleading.

Statements such as the following may attract scrutiny:

• “guaranteed returns”;
• “risk-free crypto investment”;
• “your funds can never be lost”;
• “fully approved” before licensing;
• “the safest crypto platform in Kenya”; or
• “stablecoin always redeemable” without adequate qualification.

Influencers, affiliates and third-party marketers should also operate within an approved compliance framework.

The licensed business may remain responsible for promotional activity carried out on its behalf.

16. The Kenya Crypto Licence Application Process

Step 1: Map the business model

Document every product, transaction and revenue stream.

Identify:

• who contracts with customers;
• who controls fiat;
• who controls crypto;
• who executes transactions;
• who provides custody;
• who handles settlement;
• which third parties are involved; and
• which entity earns the revenue.

Step 2: Identify the licence category

Determine whether the activity requires:

• exchange;
• broker;
• wallet;
• payment processor;
• investment adviser;
• manager;
• ICO;
• tokenisation;
• token issuance platform; or
• stablecoin approval.

Also determine whether CBK, CMA or both are relevant.

Step 3: Structure the applicant

Incorporate or register the eligible Kenyan company.

Finalise:

• ownership;
• beneficial ownership;
• governance;
• directors;
• senior management;
• principal office;
• group structure; and
• intellectual-property arrangements.

Step 4: Conduct a licensing-readiness assessment

Review:

• capital;
• financial resources;
• staffing;
• technology;
• cybersecurity;
• compliance;
• customer agreements;
• outsourcing;
• policies; and
• governance.

Prepare a gap-analysis report.

Step 5: Capitalise the company

Inject genuine paid-up capital and establish any required liquid-capital buffer.

Prepare clear source-of-funds evidence.

Step 6: Prepare the application documents

Draft the:

• business plan;
• financial model;
• fit-and-proper forms;
• operational policies;
• customer agreements;
• governance framework;
• outsourcing contracts;
• business rules; and
• technical documentation.

Step 7: Complete technology assurance

Conduct:

• systems audit;
• vulnerability assessment;
• penetration testing;
• remediation; and
• final reporting.

Step 8: Submit the application

File the prescribed form, supporting documents and application fee with the correct regulator.

Step 9: Respond to regulatory questions

The regulator may request:

• additional documents;
• source-of-funds clarification;
• interviews;
• platform demonstrations;
• policy amendments;
• financial revisions;
• ownership information; or
• further technology evidence.

Step 10: Receive approval and pay the licence fee

Once the regulator is satisfied, the licence may be issued after payment of the initial licence fee.

17. How Long Does a Kenya VASP Licence Take?

The final Regulations state that the regulator should determine an application within 30 days after:

• receiving all required documents and information; and
• completing due diligence on the applicant.

This does not mean every Kenya crypto licence will be issued within 30 days of the first submission.

The statutory period does not necessarily begin while:

• documents are missing;
• due diligence remains incomplete;
• interviews are outstanding;
• technical reports are inadequate;
• regulatory questions remain unanswered; or
• The applicant is still correcting material deficiencies.

A practical project timeline may include:

The timeline will vary significantly between a small advisory business and a multi-activity exchange with custody, payments and international operations.

18. Why Kenya Crypto Licence Applications Are Rejected or Delayed

The final Regulations permit rejection where:

• the applicant fails to respond to requests for clarification;
• the applicant fails to attend a requested interview;
• directors, senior officers or beneficial owners do not satisfy fit-and-proper requirements;
• the applicant has a history of regulatory or AML non-compliance; or
• approval may pose a risk to financial stability.

Other recurring problems include the following.

Applying for the wrong licence

The company calls itself a broker but operates an exchange.

It claims to be non-custodial but controls withdrawals.

It claims to provide software only but enters into customer transactions and earns spreads.

Unclear ownership

The beneficial owners cannot be identified or the ownership chain contains unexplained entities.

Weak source-of-funds evidence

The capital cannot be traced to a credible and lawful source.

Nominal management

Directors and senior officers do not understand the business or exercise actual control.

Generic policies

The documents do not reflect the applicant’s platform, assets, customers or transaction flows.

Immature technology

The platform cannot be properly tested or contains unresolved critical vulnerabilities.

Unrealistic financial forecasts

Projected customer growth is inconsistent with staffing, compliance capacity and technology expenditure.

Insufficient operational funding

The applicant meets the minimum capital requirement but lacks a credible operating runway.

Contradictory documents

The business plan, customer terms, website, technology diagrams and financial model describe different businesses.

A successful application must present one coherent and verifiable operating model.

19. What Happens After the Licence Is Granted?

A Kenya crypto licence is an ongoing regulatory obligation, not a one-off approval.

The licensed VASP must continue complying with requirements relating to:

• capital;
• solvency;
• liquidity;
• governance;
• fit and proper status;
• AML/CFT/CPF;
• cybersecurity;
• safeguarding;
• consumer protection;
• market conduct;
• audits;
• records;
• reporting;
• outsourcing; and
• complaints.

The licence must be renewed annually, and the renewal application must be submitted at least two months before expiry.

The business must commence its licensed virtual asset activity within 12 months of the licence grant.

Material changes may require notification or prior approval, including changes to:

• ownership;
• control;
• directors;
• senior officers;
• business model;
• regulated activities;
• critical outsourcing;
• custody;
• principal office;
• capital position; or
• technology infrastructure.

A licensed VASP should maintain a formal regulatory-change management process.

20. Can a Startup Get a Kenya Crypto Licence?

Yes.

The law does not limit licensing to large international exchanges.

However, a startup must meet the same fundamental regulatory standards applicable to its licence category.

It must demonstrate:

• transparent ownership;
• credible funding;
• suitable management;
• adequate capital;
• proportionate staffing;
• secure technology;
• effective AML systems;
• consumer safeguards;
• realistic projections; and
• sustainable operations.

A startup should consider whether it needs to launch every proposed service at once.

For example, a founder may initially plan to offer:

• exchange;
• custody;
• payments;
• brokerage;
• staking;
• lending;
• token issuance; and
• investment management.

That model may create excessive capital, technology and compliance complexity.

A phased launch focused on one or two clearly defined activities may be more achievable, provided the structure reflects the genuine business and is not designed merely to disguise regulated functions.

21. Practical Questions to Answer Before Applying

Before applying for a Kenya VASP licence, a founder should be able to answer the following questions.

Regulatory scope

• What exactly will the company do?
• Which services are regulated?
• Does the company need one or several licences?
• Is CBK, CMA or both responsible?
• Is the business targeting Kenyan customers?

Ownership and governance

• Who are the ultimate beneficial owners?
• Where does the investment capital come from?
• Who will sit on the board?
• Who will manage the Kenyan business?
• Are the proposed officers fit and proper?

Customer assets

• Who holds customer fiat?
• Who holds customer virtual assets?
• Who controls the private keys?
• Are customer assets segregated?
• What happens if a custodian fails?

Technology

• Is the platform sufficiently developed for audit?
• Has penetration testing been completed?
• Are critical vulnerabilities resolved?
• How are keys and customer data protected?
• What happens during a cybersecurity incident?

Compliance

• How will customers be verified?
• Which blockchain-analytics system will be used?
• How will sanctions and high-risk wallets be screened?
• How will suspicious transactions be reported?
• How will Travel Rule obligations be satisfied?

Finance

• What is the paid-up capital requirement?
• What liquid capital must be maintained?
• What is the 12-month operating budget?
• Can the business remain capitalised after launch?
• Are the financial projections realistic?

An applicant that cannot answer these questions is probably not ready to file.

22. How CRYPTOVERSE Can Help With a Kenya Crypto Licence

Securing a Kenya VASP licence requires much more than completing an application form.

It requires coordinated legal, regulatory, financial, technical and operational preparation.

CRYPTOVERSE Legal Consultancy can support virtual asset businesses with:

• regulatory perimeter assessments;
• Kenya VASP licence-category mapping;
• CBK and CMA regulatory analysis;
• market-entry structuring;
• company and ownership structuring;
• capital and liquidity planning;
• licensing-readiness reviews;
• regulatory business plans;
• financial projections;
• fit-and-proper applications;
• AML/CFT/CPF frameworks;
• sanctions and Travel Rule procedures;
• governance policies;
• consumer-protection frameworks;
• customer terms;
• outsourcing agreements;
• market-conduct policies;
• coordination of systems audits and penetration testing;
• licence application preparation;
• responses to regulatory information requests;
• management interview preparation;
• approval-condition closure; and
• post-licensing compliance support.

The objective is not simply to produce a set of documents.

It is to help the applicant build a coherent, credible and sustainable virtual asset business that can withstand regulatory scrutiny.

Conclusion: A Kenya Crypto Licence Must Be Designed Into the Business

Many founders treat licensing as the final administrative step before launch.

They first build the platform.

Then they sign commercial partners.

Then they advertise.

Then they open customer registrations.

Only afterwards do they ask whether a licence is required.

That sequence can be costly.

A regulatory review may reveal that the company must:

• change its legal entity;
• restructure ownership;
• appoint new management;
• increase capital;
• redesign custody;
• replace service providers;
• amend transaction flows;
• rebuild compliance systems;
• rewrite customer agreements;
• suspend marketing; or
• remove services from the platform.

The better approach is to build the Kenya crypto licence requirements into the business from the beginning.

Before launching, determine:

1. which regulated activities the company performs;
2. whether CBK, CMA or both will supervise it;
3. whether the business requires one or several licences;
4. whether the ownership and management structure is acceptable;
5. how much capital and liquidity must be maintained;
6. whether the technology is ready for independent testing;
7. how AML and blockchain monitoring will operate;
8. how consumer assets will be protected;
9. what the complete licensing project will cost; and
10. how ongoing compliance will be managed.

Kenya’s new framework creates a clear route for responsible virtual asset businesses.

It also makes clear that a crypto business cannot rely on vague labels, foreign incorporation or a technology-first approach to avoid regulation.

The decisive question is not:

“Can we launch a crypto platform in Kenya?”

It is:

“Have we built the kind of virtual asset business that CBK or CMA can confidently license?”

FAQs