CBK vs CMA: Which Kenyan Regulator Will License Your Crypto Business?

Understanding Kenya’s Dual-Regulator Model for Virtual Asset Service Providers

One of the first questions every crypto entrepreneur asks after deciding to launch in Kenya is:

“Which regulator do I need to apply to?”

Many founders assume there is a single crypto regulator.

There isn’t.

Unlike some jurisdictions where one authority supervises every virtual asset business, Kenya has adopted a dual-regulator model. Depending on the services you intend to provide, your business may fall under the supervision of either:

• the Central Bank of Kenya (CBK);
• the Capital Markets Authority (CMA); or
• in certain cases, both regulators.

Choosing the wrong regulator can be one of the most expensive mistakes an applicant makes.

It may lead to:

• months of delay;
• unnecessary legal costs;
• incorrect capital planning;
• inappropriate compliance frameworks;
• rejected applications; or
• an unlawful launch.

The Virtual Asset Service Providers Act, 2025 establishes Kenya’s regulatory framework for virtual asset businesses and allocates supervisory responsibility between CBK and CMA according to the nature of the regulated activity. The Virtual Asset Service Providers Regulations, 2026 then prescribe the licensing, prudential and operational requirements for each category of Virtual Asset Service Provider (VASP).

This guide explains how Kenya’s regulatory framework works, which regulator licences which activities, and how founders can determine the correct licensing pathway before investing significant time and capital.

Why Kenya Uses Two Regulators

Not every crypto business performs the same function.

Some businesses primarily move money.

Others facilitate investment.

Some safeguard customer assets.

Others issue digital tokens.

Each activity creates different risks.

For example:

A company that processes crypto payments for merchants raises issues relating to:

• payments;
• settlement;
• liquidity;
• financial stability; and
• customer funds.

A tokenisation platform, on the other hand, raises questions relating to:

• investments;
• market conduct;
• disclosures;
• investor protection;
• issuance; and
• trading.

Rather than assigning every activity to a single authority, Kenya divided regulatory responsibility according to each regulator’s existing expertise.

Broadly speaking:

Central Bank of Kenya (CBK)

CBK supervises activities that resemble:

• payment services;
• stored value;
• settlement;
• custody of customer assets; and
• monetary stability.

Capital Markets Authority (CMA)

CMA supervises activities involving:

• investments;
• trading;
• brokerage;
• portfolio management;
• token offerings;
• investment advice; and
• capital formation.

Although both regulate virtual assets, their regulatory objectives differ.

Understanding that distinction is the key to identifying the correct licensing authority.

When CBK Is Your Regulator

CBK generally supervises businesses where crypto functions similarly to money or payment infrastructure.

Under the current framework, CBK is responsible for licensing:

• Virtual Asset Wallet Providers
• Virtual Asset Payment Processors
• Stablecoin Issuers

These activities involve significant responsibility for customer assets and financial infrastructure.

1. Virtual Asset Wallet Providers

A wallet provider holds or safeguards customers’ private keys or otherwise controls access to customer virtual assets.

Examples include:

• hosted wallets;
• custodial wallets;
• institutional custody platforms;
• exchange wallets;
• enterprise custody services;
• multi-signature custody solutions.

The key regulatory question is:

Who controls the customer’s private keys?

If the business can move customer assets without customer intervention, CBK is likely to regard it as providing custodial wallet services.

2. Virtual Asset Payment Processors

Payment processors facilitate payments using virtual assets.

Typical services include:

• merchant payment gateways;
• crypto checkout solutions;
• payment acceptance;
• merchant settlement;
• invoice settlement;
• payment routing;
• crypto-to-fiat conversion for merchants.

These businesses resemble payment institutions more than investment firms.

Consequently, they fall within CBK’s supervisory mandate.

3. Stablecoin Issuers

Stablecoin issuers create and redeem digital tokens designed to maintain a stable value.

Because stablecoins may affect:

• payments;
• settlement;
• liquidity;
• reserves;
• monetary transmission; and
• financial stability,

their regulation falls within CBK’s remit.

Stablecoin issuers also face the highest minimum paid-up capital requirement under the Regulations.

What CBK Focuses On

When reviewing an application, CBK is particularly interested in whether the applicant can safely operate financial infrastructure.

Its review is therefore likely to focus on:

• customer asset safeguarding;
• payment flows;
• liquidity;
• reserve management;
• cybersecurity;
• operational resilience;
• outsourcing;
• settlement;
• business continuity;
• financial crime controls; and
• prudential capital.

A payment processor with weak safeguarding arrangements presents very different risks from an investment adviser.

That explains why CBK’s supervisory priorities differ from CMA’s.

When CMA Is Your Regulator

CMA supervises businesses primarily involved in investment activities.

These include:

• Virtual Asset Exchanges
• Virtual Asset Brokers
• Virtual Asset Investment Advisers
• Virtual Asset Managers
• Initial Coin Offering Providers
• Token Issuance Platforms
• Virtual Asset Tokenisation Providers

These businesses resemble traditional capital markets.

1. Virtual Asset Exchanges

An exchange provides a marketplace where buyers and sellers trade virtual assets.

Examples include:

• spot exchanges;
• matching engines;
• trading platforms;
• exchange order books;
• digital asset marketplaces.

CMA examines matters such as:

• market integrity;
• listing standards;
• market surveillance;
• conflicts of interest;
• order execution;
• trading transparency;
• investor protection.

2. Virtual Asset Brokers

Brokers arrange or execute transactions for customers.

Typical examples include:

• OTC brokers;
• agency brokers;
• execution-only brokers;
• institutional brokers.

The broker normally facilitates transactions rather than operating an exchange.

3. Virtual Asset Investment Advisers

These businesses provide investment advice relating to virtual assets.

Examples include:

• investment recommendations;
• portfolio advice;
• market research;
• token investment analysis.

They do not necessarily hold customer assets.

4. Virtual Asset Managers

Managers make investment decisions on behalf of customers.

Examples include:

• discretionary portfolio management;
• managed crypto portfolios;
• institutional asset management.

This differs significantly from providing investment advice alone.

5. Initial Coin Offering Providers

These businesses assist projects raising capital through token offerings.

Services may include:

• ICO structuring;
• fundraising;
• disclosure preparation;
• issuance coordination.

6. Token Issuance Platforms

These platforms facilitate the issuance of new digital tokens.

Examples include:

• token launchpads;
• issuance infrastructure;
• token deployment platforms.

7. Tokenisation Providers

Tokenisation providers convert real-world assets into blockchain-based digital tokens.

Assets may include:

• real estate;
• commodities;
• investment funds;
• receivables;
• infrastructure assets.

Tokenisation has become one of the fastest-growing regulated sectors globally.

What CMA Focuses On

CMA’s review is generally investment-focused.

Typical areas include:

• investor protection;
• governance;
• disclosures;
• conflicts of interest;
• market conduct;
• token economics;
• custody arrangements;
• financial projections;
• management competence;
• compliance frameworks.

Its objective is ensuring that virtual asset investment markets operate fairly and transparently.

Comparing CBK and CMA

The regulators share certain objectives—including AML/CFT compliance, governance and consumer protection—but their supervisory emphasis differs.

Businesses That May Involve Both Regulators

Many crypto startups offer several services through one platform.

For example:

A customer may:

1. deposit fiat;
2. purchase Bitcoin;
3. store Bitcoin;
4. send Bitcoin;
5. spend Bitcoin.

Although the experience appears seamless, several regulated activities may occur simultaneously.

Example 1: Exchange + Custodial Wallet

Services include:

• trading;
• hosted wallets;
• custody.

Potential regulators:

• CMA (exchange)
• CBK (wallet)

Example 2: Exchange + Merchant Payments

Services include:

• trading;
• merchant settlement;
• payment processing.

Potential regulators:

• CMA
• CBK

Example 3: Stablecoin + Payments

Services include:

• issuing stablecoins;
• processing payments.

Both activities fall primarily within CBK’s supervisory framework.

Example 4: Tokenisation + Secondary Trading

Services include:

• tokenisation;
• exchange trading.

The tokenisation component falls under CMA, while any additional custodial features should be analysed separately to determine whether CBK licensing is also required.

How Regulators Determine Your Licence

The regulator will not rely on:

• your website description;
• your marketing material;
• your company name.

Instead, it will analyse:

• customer journey;
• transaction flow;
• wallet architecture;
• revenue model;
• custody arrangements;
• contracts;
• technology;
• settlement;
• governance.

A business calling itself:

“Blockchain Software Limited”

may still require a VASP licence.

Likewise:

A company calling itself:

“Crypto Exchange”

may not require an exchange licence if it merely provides software without operating the trading venue.

The regulator examines substance rather than branding.

Questions Every Founder Should Answer

Before choosing a regulator, answer the following:

Do you hold customer private keys?

If yes, CBK may become relevant.

Do customers trade with one another?

If yes, CMA is likely involved.

Do you merely arrange trades?

Brokerage activities generally point toward CMA.

Do you process merchant payments?

This generally falls within CBK’s remit.

Are you issuing tokens?

Token issuance activities generally involve CMA.

Are you issuing stablecoins?

CBK supervision is likely.

Do you manage customer portfolios?

Portfolio management is generally regulated by CMA.

Do you provide only investment advice?

Investment advisory services generally fall under CMA.

Common Regulatory Mistakes

Assuming “crypto” means CMA

Not every crypto activity is investment-related. Payment infrastructure may instead fall within CBK.

Assuming payment services avoid regulation

Payment businesses are among the most heavily regulated.

Ignoring custody

Adding hosted wallets can fundamentally change the regulatory analysis.

Expanding products without reassessing licences

A broker adding exchange functionality may require additional licensing.

Outsourcing custody without analysing control

Even if a third party stores assets, regulatory responsibility depends on who exercises actual control.

Treating technology as the regulated activity

The regulator analyses what the business does—not the software it uses.

Should You Speak to Both Regulators?

Sometimes yes.

Where a proposed business clearly combines activities allocated to different authorities, early regulatory engagement may avoid:

• incorrect applications;
• duplicated work;
• inconsistent business plans;
• inappropriate capital planning;
• unnecessary delays.

Applicants should not assume that one licence automatically authorises every future product.

A phased strategy is often more efficient.

For example:

Phase One

Launch:

• brokerage;
• advisory.

Phase Two

Add:

• exchange;
• custody.

Phase Three

Introduce:

• payment processing;
• stablecoin services.

Each phase can then be evaluated against the applicable regulatory requirements before expansion.

A Regulatory Decision Tree

Use the following simplified guide:

If your business combines several of these activities, a more detailed regulatory-perimeter assessment is essential.

How CRYPTOVERSE Can Help

Choosing the wrong regulator is one of the most common—and most avoidable—mistakes made by crypto startups entering Kenya.

CRYPTOVERSE Legal Consultancy assists founders by providing:

• regulatory perimeter assessments;
• CBK and CMA activity mapping;
• licence-category analysis;
• business-model reviews;
• transaction-flow analysis;
• applicant structuring;
• multi-licence planning;
• capital-planning advice;
• regulatory business plans;
• application preparation;
• licensing-readiness reviews; and
• ongoing regulatory compliance support.

Our objective is to identify the correct regulator before significant capital, technology and legal costs are incurred.

Conclusion: Your Business Model Determines Your Regulator

Founders often begin by asking:

“Should I apply to CBK or CMA?”

The better question is:

“What regulated activities will my business actually perform?”

Once that question is answered, the appropriate regulator usually becomes much clearer.

If your business focuses primarily on:

• custody;
• payments;
• wallet services; or
• stablecoin issuance,

CBK is likely to play the principal supervisory role.

If your business focuses on:

• trading;
• brokerage;
• investment advice;
• portfolio management;
• token offerings; or
• tokenisation,

CMA will generally be the primary regulator.

For businesses that combine several services, the analysis becomes more complex and should be completed before incorporation, fundraising or product development.

Choosing the correct regulator at the outset does far more than reduce licensing delays.

It influences:

• capital requirements;
• governance;
• compliance obligations;
• technology architecture;
• customer agreements;
• operating costs; and
• the long-term scalability of the business.

The strongest applications begin with a clear understanding of regulatory jurisdiction—not after the application has already been submitted.

FAQs