Part 1: Understanding the Kenya VASP Licence, Regulated Activities and the Correct Licensing Route

Kenya VASP Licence: Complete Requirements, Costs, Capital and Application Process

A crypto founder may look at Kenya and see a straightforward commercial opportunity.

The country has a large digitally connected population, established mobile-payment infrastructure and growing demand for faster, more accessible ways to transfer, store and invest value. The founder may already operate a successful exchange, wallet, payment platform or OTC desk in another jurisdiction and believe the Kenyan expansion will involve little more than incorporating a local company and connecting to domestic payment channels.

Then the regulatory questions begin.

Will the platform hold customers’ private keys?

Will customers be able to exchange Kenyan shillings for virtual assets?

Will the company process merchant payments?

Will it arrange OTC transactions?

Will it issue tokens or permit third-party projects to raise funds through the platform?

Will it target Kenyan customers from an offshore entity?

Each answer can change the licensing analysis.

Under Kenya’s new regulatory framework, a crypto business is not classified merely by the name placed on its website. The regulators will examine the substance of the business: the services provided, the customer journey, the movement of fiat currency and virtual assets, the control of private keys, the contractual relationships and the company’s sources of revenue.

A business marketed as a “blockchain platform” may, in practice, operate as a virtual asset exchange. A “technology facilitator” may be providing regulated crypto payment services. A “liquidity consultant” may be acting as a virtual asset broker. A “self-custody wallet” may become custodial if the provider retains sufficient control over transaction authorisation or wallet recovery.

This is why obtaining a Kenya VASP licence begins with understanding the business model—not completing an application form.

This three-part guide explains the complete framework for securing a VASP licence in Kenya, including:

• who needs a licence;
• the activities regulated by CBK and CMA;
• licensing requirements;
• minimum capital and liquidity;
• regulatory fees and real project costs;
• application documents;
• fit-and-proper assessments;
• AML, cybersecurity and consumer-protection obligations;
• the application process and timeline;
• common grounds for delay or rejection; and
• post-licensing compliance.

Part 1 focuses on the regulatory perimeter: what a Kenya VASP licence is, who must obtain one, which regulator is responsible and how the different licence categories apply to real business models.

1. What Is a Kenya VASP Licence?

A Kenya VASP licence is a regulatory authorisation permitting an eligible company to carry on one or more specified virtual asset services in or from Kenya.

“VASP” means Virtual Asset Service Provider.

Under the Virtual Asset Service Providers Act, 2025, a virtual asset service provider is a company licensed to conduct virtual asset services. A licence may authorise one or more permissible activities, subject to the conditions imposed by the relevant regulatory authority.

A Kenya VASP licence is not the same as:

• incorporating a company;
• registering a foreign company in Kenya;
• obtaining a general business permit;
• registering for tax;
• opening a corporate bank account;
• securing approval from a payment partner;
• joining a blockchain association; or
• holding a crypto licence in another country.

These steps may support the business, but they do not replace regulatory authorisation.

A company may therefore be validly incorporated under Kenyan company law while still being prohibited from offering regulated crypto services.

For example, a company may register objects covering “software development”, “financial technology” or “blockchain solutions”. That registration does not authorise it to:

• operate a crypto exchange;
• hold customer virtual assets;
• arrange OTC transactions;
• process crypto payments;
• manage crypto portfolios;
• issue investment tokens; or
• issue a stablecoin.

The correct crypto business licence in Kenya depends on the activity conducted rather than the company’s incorporation wording.

2. The Legal Framework for Crypto Licensing in Kenya

Kenya’s virtual asset regime is principally based on:

• the Virtual Asset Service Providers Act, 2025, now published as Cap. 491B; and
• the Virtual Asset Service Providers Regulations, 2026, issued under Legal Notice No. 134.

The Act establishes the legislative framework for licensing and regulating virtual asset service providers. It identifies the regulators, creates the licensing requirement, sets out general obligations and provides enforcement powers.

The 2026 Regulations operationalise that framework. They provide the detailed rules governing:

• licence applications;
• application documents;
• licence fees;
• capital and liquidity;
• governance;
• staffing;
• operational policies;
• cybersecurity;
• safeguarding of customer assets;
• market conduct;
• advertising;
• token offerings;
• tokenisation;
• stablecoin issuance;
• inspections;
• reporting;
• sanctions; and
• licence renewal.

The Regulations expressly apply to persons offering virtual asset services in or from Kenya. They also cover businesses that target Kenyan consumers or derive income or economic benefit from Kenya, even without a physical presence in the country.

This territorial rule is particularly important for international exchanges, wallet businesses and payment companies.

3. Is Cryptocurrency Legal in Kenya?

Yes, but providing regulated virtual asset services requires the appropriate licence.

Kenya has not imposed a general ban on virtual assets. Instead, it has adopted an activity-based regulatory model.

The distinction between personal use and commercial service provision is important.

An individual holding Bitcoin as a personal investment is not the same as a company operating a platform through which thousands of Kenyan customers buy and sell Bitcoin.

Similarly:

• owning crypto is different from safeguarding crypto for customers;
• creating blockchain software is different from operating an exchange;
• publishing general educational content is different from giving personalised investment advice;
• accepting a one-off crypto payment is different from operating a payment-processing business; and
• creating a digital collectible is different from issuing a token as an investment or fundraising instrument.

The licensing obligation generally arises where a company carries on a regulated activity commercially in or from Kenya.

Accordingly, the question should not simply be:

“Is crypto legal in Kenya?”

The commercially useful question is:

“Does my business model involve a regulated virtual asset service requiring a Kenya VASP licence?”

4. Who Regulates Virtual Asset Businesses in Kenya?

Kenya uses a dual-regulator structure.

The principal authorities are:

• the Central Bank of Kenya, or CBK; and
• the Capital Markets Authority, or CMA.

The correct regulator depends on the proposed activity.

4.1 Central Bank of Kenya

CBK is responsible for licensing and supervising:

• virtual asset wallet providers;
• virtual asset payment processors; and
• stablecoin issuers.

These activities are closely connected to custody, payments, settlement, reserves and financial stability.

4.2 Capital Markets Authority

CMA is responsible for:

• virtual asset exchanges;
• virtual asset brokers;
• virtual asset investment advisers;
• virtual asset managers;
• initial coin offering providers;
• virtual asset tokenisation providers; and
• token issuance platforms.

These activities are more closely associated with trading, brokerage, investment, portfolio management, fundraising and market conduct.

Why the CBK–CMA distinction matters

A business should not select its regulator based only on which authority appears more convenient.

The allocation follows the underlying activity.

Consider a mobile application offering the following services:

1. customers deposit Kenyan shillings;
2. the company converts the funds into USDT;
3. customers store the USDT in a hosted wallet;
4. customers exchange USDT for Bitcoin; and
5. customers use their virtual assets to pay merchants.

That single platform may involve:

• payment processing;
• custodial wallet services; and
• virtual asset exchange.

The payment and custody functions may fall within CBK’s mandate, while the exchange function may fall within CMA’s mandate.

A regulatory perimeter assessment must therefore be completed before the applicant determines its licensing route.

5. Can One Company Obtain More Than One Kenya VASP Licence?

Potentially, yes.

The Regulations allow an applicant to seek approval for more than one permissible activity where the relevant authority is satisfied that the activities either:

• constitute distinct business lines with independent risk profiles, infrastructure or operational controls; or
• share appropriate common infrastructure, risk profiles or operational controls.

This does not mean that every applicant should apply for numerous activities.

A broad licence application may increase:

• capital requirements;
• policy requirements;
• technical complexity;
• staffing needs;
• regulatory scrutiny;
• implementation costs; and
• the likelihood of inconsistent application documents.

A founder should distinguish between:

• services that are necessary for the initial business model;
• services that may be added later;
• services outsourced to licensed third parties; and
• services included merely because the business may offer them someday.

The application should reflect a credible launch model rather than an aspirational list of unrelated activities.

6. Kenya VASP Licence Categories

6.1 Virtual Asset Exchange Licence

A virtual asset exchange facilitates the buying, selling or trading of virtual assets.

The platform may enable:

• fiat-to-crypto transactions;
• crypto-to-fiat transactions;
• crypto-to-crypto transactions;
• order matching;
• peer-to-peer trading;
• request-for-quotation transactions;
• automated conversions; or
• settlement between buyers and sellers.

The Act defines a virtual asset trading platform by reference to a digital platform that facilitates virtual asset exchange or trading for a fee, commission or other benefit and either controls customer assets or purchases assets from matched sellers for resale to buyers.

A company seeking a crypto exchange licence in Kenya should expect the regulator to examine:

• trading architecture;
• order execution;
• pricing;
• liquidity;
• settlement;
• custody;
• token admission;
• listing and delisting;
• market surveillance;
• conflicts of interest;
• market abuse;
• cybersecurity; and
• customer disclosures.

A crypto exchange licence should not automatically be assumed to cover wallet or payment services.

6.2 Virtual Asset Broker Licence

A virtual asset broker arranges, facilitates or executes crypto transactions for customers.

The business may:

• operate an OTC desk;
• receive customer orders;
• source virtual assets from liquidity providers;
• introduce buyers and sellers;
• negotiate transaction terms;
• execute trades through third-party platforms;
• arrange block transactions; or
• earn a commission, fee or spread.

An OTC operation does not avoid licensing simply because it has no public order book.

For example, a client asks a company to purchase KSh 10 million worth of USDT. The company obtains a price from a liquidity provider, adds its margin and completes the transaction for the client.

The company may be performing regulated virtual asset brokerage.

The regulator will examine the company’s actual role, not whether it describes itself as an “introducer”, “consultant” or “facilitator”.

6.3 Virtual Asset Wallet Provider Licence

A wallet provider may require a CBK licence where it holds or manages private keys for customers.

Services may include:

• hosted retail wallets;
• institutional custody;
• hot-wallet management;
• cold storage;
• multi-signature custody;
• transaction authorisation;
• deposits and withdrawals;
• key recovery; and
• safeguarding of virtual assets.

The Act defines a custodial wallet as one in which a third party holds and manages the private keys for proof of ownership and transaction facilitation.

The decisive question is control.

Even where a product is advertised as “non-custodial”, the provider should assess whether it can:

• recover the wallet;
• reconstruct keys;
• approve or block transactions;
• freeze withdrawals;
• alter smart-contract permissions;
• access customer assets; or
• exercise administrative authority over the wallet.

Where the provider retains meaningful control, the service may still be treated as custodial.

6.4 Virtual Asset Payment Processor Licence

A virtual asset payment processor facilitates transactions involving fiat currency and virtual assets or transactions between virtual assets.

Potential services include:

• merchant crypto-payment gateways;
• crypto checkout tools;
• fiat-to-crypto on-ramps;
• crypto-to-fiat off-ramps;
• virtual asset remittances;
• payment routing;
• merchant settlement;
• payment collection; and
• stablecoin payment infrastructure.

Suppose a merchant wants to accept USDT but receive Kenyan shillings.

A payment provider receives the transaction instruction, routes the USDT to a liquidity partner, arranges conversion and settles Kenyan shillings to the merchant.

Even where conversion or custody is outsourced, the customer-facing company may still be providing a regulated payment service.

The analysis will consider:

• who contracts with the merchant;
• who receives the payment instruction;
• who routes the transaction;
• who manages failed transactions;
• who handles refunds;
• who bears settlement risk; and
• who earns the processing fee.

6.5 Virtual Asset Investment Adviser Licence

A company may require an investment adviser licence where it provides advice or recommendations concerning virtual assets.

This may include:

• personalised token recommendations;
• crypto portfolio advice;
• suitability assessments;
• recommendations to buy, hold or sell;
• advice concerning token offerings;
• investment research tailored to a client; or
• recommendations concerning tokenised assets.

General education and public commentary may be treated differently from personalised advice.

However, using the disclaimer “not financial advice” will not change the nature of a service that is, in substance, individualised investment advice provided for payment.

6.6 Virtual Asset Manager Licence

A virtual asset manager exercises discretion over a customer’s assets or portfolio.

It may decide:

• which assets to buy;
• when to trade;
• how much to invest;
• when to rebalance;
• when to dispose of assets; and
• how to execute the agreed investment strategy.

Potential models include:

• managed crypto accounts;
• discretionary virtual asset portfolios;
• algorithmic portfolio management;
• institutional investment mandates; and
• some digital asset fund structures.

Depending on the structure, additional securities, fund, custody or collective investment regulation may also apply.

6.7 Initial Coin Offering Provider

A company raising funds by issuing and offering virtual assets may require approval as an initial coin offering provider.

The regulator may examine:

• the issuer;
• promoters;
• the token’s rights;
• the white paper;
• fundraising terms;
• investor eligibility;
• subscription arrangements;
• advertising; and
• admission to trading.

Calling a token a “utility token” does not automatically place it outside the regime.

The legal analysis will consider:

• how the token functions;
• whether it is transferable;
• what purchasers receive;
• whether purchasers expect returns;
• whether it represents an asset or financial claim; and
• how it is marketed.

6.8 Virtual Asset Tokenisation Provider Licence

Tokenisation involves converting rights in a real-world asset into digital tokens recorded on distributed ledger technology.

Potential underlying assets include:

• real estate;
• commodities;
• precious metals;
• receivables;
• intellectual property;
• income-generating contracts;
• art; and
• financial claims.

A tokenisation licence in Kenya does not replace compliance with the law governing the underlying asset.

A real estate tokenisation project may also engage:

• land law;
• securities regulation;
• company law;
• collective investment rules;
• valuation;
• custody;
• tax;
• insolvency; and
• investor protection.

The token should therefore be designed only after the legal ownership and investor-rights structure has been established.

6.9 Token Issuance Platform Licence

A token issuance platform provides infrastructure through which third-party issuers can create, distribute or offer virtual assets.

Examples include:

• launchpads;
• token subscription platforms;
• digital issuance portals;
• primary token marketplaces; and
• fundraising infrastructure.

Although the platform may not be the issuer, it may be responsible for:

• issuer due diligence;
• disclosure review;
• investor onboarding;
• subscription processing;
• token distribution;
• customer money; and
• admission to trading.

These functions create significant gatekeeping and consumer-protection responsibilities.

6.10 Stablecoin Issuer Licence

A stablecoin issuer creates a virtual asset designed to maintain a stable value relative to reserve assets such as:

• fiat currency;
• commodities;
• other virtual assets; or
• a basket of assets.

A stablecoin licence in Kenya is one of the most demanding VASP permissions.

The licensing framework addresses:

• stablecoin white papers;
• issuance;
• redemption;
• reserve assets;
• custody of reserves;
• permitted investment of reserve funds;
• audit;
• reporting;
• conflicts of interest;
• public disclosures;
• marketing; and
• suspension or delisting.

The issuer must demonstrate that its representations about stability and redemption are supported by credible legal, financial and operational arrangements.

7. Does a Foreign Crypto Company Need a Kenya VASP Licence?

Potentially, yes.

The final Regulations extend beyond companies physically located in Kenya.

A business is considered to operate “in or from Kenya” where it:

• actively solicits or targets local consumers; or
• derives economic benefit or income from Kenya,

regardless of whether it has a physical presence in the country.

This means an overseas crypto company cannot assume it is outside the Kenyan framework merely because:

• it is incorporated abroad;
• its servers are hosted outside Kenya;
• customer assets are held offshore;
• management is located overseas;
• it has no Kenyan office; or
• its terms are governed by foreign law.

Indicators of targeting Kenyan customers

A foreign VASP may fall within scope where it:

• permits Kenyan residents to register;
• supports Kenyan shilling deposits or withdrawals;
• uses Kenya-specific advertising;
• engages Kenyan influencers or affiliates;
• partners with Kenyan merchants;
• supports local payment methods;
• runs Kenyan promotional campaigns;
• maintains Kenya-focused customer support; or
• earns fees from Kenyan users.

A licence held in another jurisdiction may support the applicant’s regulatory profile, but it does not provide automatic authority to operate in Kenya.

8. Who Is Eligible to Apply?

An applicant for a Kenya VASP licence must generally be:

• a company limited by shares incorporated under Kenya’s Companies Act; or
• a foreign company limited by shares registered under the Companies Act.

The applicant should have a transparent structure showing:

• directors;
• senior officers;
• shareholders;
• significant shareholders;
• ultimate beneficial owners;
• parent companies;
• affiliates; and
• controlling persons.

Under the Regulations, a significant shareholder includes a person who directly or indirectly holds, or has a beneficial interest in, more than 10% of the company’s share capital.

The regulator will need to understand:

• who owns the applicant;
• who controls its decisions;
• who funded the business;
• where the funds originated;
• which entity owns the technology;
• which entities provide critical services; and
• whether the ownership chain creates regulatory or financial-crime risks.

A complex group structure is not necessarily unacceptable. It must, however, be transparent and commercially justifiable.

9. Activities That May Fall Outside the Kenya VASP Framework

Not every digital asset or blockchain activity requires a licence.

The Act excludes certain categories, including:

• digital value operating solely within a closed ecosystem;
• central bank-issued digital representations of fiat currency;
• certain NFTs not used for payment, investment or financial purposes;
• virtual service tokens whose sole function is to provide access to a service and which are not transferable or exchangeable with third parties; and
• other categories expressly excluded by the regulator.

These exclusions should be interpreted carefully.

A token described as a loyalty point may cease to resemble a closed-ecosystem asset if it can be:

• transferred externally;
• traded on another platform;
• redeemed for cash;
• exchanged for crypto; or
• used as an investment.

Similarly, an NFT representing fractional ownership in property or rights to future income is very different from a unique digital artwork.

The function of the asset—not the label assigned by the issuer—will determine the regulatory outcome.

10. Common Misconceptions About the Kenya VASP Licence

“We are only a technology company.”

A technology business may still be regulated if it controls transactions, holds assets, contracts with customers or earns fees from regulated activity.

“We do not have an office in Kenya.”

Physical presence is not decisive where the company targets Kenyan consumers or derives income from Kenya.

“We use a licensed third-party exchange.”

Outsourcing trade execution does not necessarily remove the customer-facing company from regulation.

“We do not hold fiat currency.”

The company may still provide exchange, brokerage, custody or payment services involving virtual assets.

“Our wallet is non-custodial.”

That conclusion depends on who controls keys, recovery, transaction approvals and administrative functions.

“Our token is a utility token.”

The regulator will analyse its actual economic and technical function.

“We already have a crypto licence abroad.”

A foreign authorisation does not automatically permit the company to operate in Kenya.

Conclusion to Part 1: Start With the Activity, Not the Application Form

The most important decision in a Kenya VASP licence project is not how quickly the application can be submitted.

It is determining what the company actually does.

Before preparing documents, a founder should map:

1. every customer-facing service;
2. every movement of fiat currency;
3. every movement of virtual assets;
4. who controls private keys;
5. who executes transactions;
6. who provides settlement;
7. who contracts with customers;
8. which third parties are involved;
9. how the company earns revenue; and
10. whether the business targets or derives income from Kenya.

Only after that exercise can the company confidently determine:

• whether a licence is required;
• which licence categories apply;
• whether CBK, CMA or both are relevant;
• whether several activities can be combined;
• whether outsourcing changes the analysis; and
• whether the proposed applicant is eligible.

In Part 2, we will examine the complete Kenya VASP licence requirements, including:

• application documents;
• the regulatory business plan;
• ownership and beneficial ownership;
• fit-and-proper assessments;
• source-of-funds evidence;
• governance;
• human resources;
• AML/CFT/CPF;
• technology;
• cybersecurity;
• consumer protection; and
• activity-specific policies.

FAQs