The Complete Guide to Starting a Crypto Business in Kenya (2026): Everything You Need to Know Before Applying for a VASP Licence

Part 1: Why Kenya Has Become Africa’s Next Crypto Licensing Hub

“When James landed in Nairobi, he wasn’t looking for a crypto licence.

He was looking for an opportunity.

His company had already secured users in Nigeria, South Africa and Ghana. Kenya was next. The market was vibrant, mobile money adoption was among the highest in the world, and young entrepreneurs were embracing digital assets faster than almost anywhere else on the continent.

Within two weeks, however, everything changed.

His lawyers asked a simple question:

‘Do you actually know whether your business needs a licence in Kenya?’

James paused.

He assumed that because his exchange operated from Europe, Kenya couldn’t regulate him.

He was wrong.

The lawyers explained that Kenya’s new Virtual Asset Service Providers (VASP) framework looks beyond where a company is incorporated. If a business actively targets Kenyan customers or earns income from Kenya, it may fall within the country’s licensing regime.

That single conversation changed the company’s expansion strategy.

Instead of rushing into the market, James invested in regulatory compliance. Six months later, the company entered Kenya with confidence, credibility and a clear roadmap for long-term growth.

Today, more crypto founders are asking the same question James once asked:

‘How do I legally start a crypto business in Kenya?’

This guide answers that question.

Whether you are launching a crypto exchange, custodial wallet, payment platform, OTC brokerage, tokenisation platform, stablecoin project or Web3 investment business, this article walks you through the regulatory landscape created by the Virtual Asset Service Providers Act, 2025 and the Virtual Asset Service Providers Regulations, 2026.

By the end of this three-part guide, you will understand:

• which regulator oversees your business;
• whether your activities require a licence;
• the licensing requirements;
• application process;
• capital requirements;
• regulatory costs;
• common mistakes founders make; and
• how to build a crypto business that regulators—and investors—can trust.

Let’s begin.

Chapter 1: Kenya Has Entered a New Era for Crypto Businesses

For years, Kenya was one of Africa’s most active crypto markets despite having no dedicated licensing framework.

Entrepreneurs built exchanges.

Developers launched blockchain products.

FinTech companies experimented with digital assets.

Investors traded Bitcoin, Ethereum and stablecoins.

Yet there remained one major uncertainty.

What exactly was legal?

Without a dedicated licensing framework, businesses operated in an environment where regulatory expectations were evolving, making long-term planning difficult.

That uncertainty has now changed.

Kenya has enacted a comprehensive legal framework under Kenya’s VASP Act 2025 licensing and compliance guide governing virtual asset businesses through:

• the Virtual Asset Service Providers Act, 2025; and
• the Virtual Asset Service Providers Regulations, 2026.

Rather than banning crypto, Kenya has chosen something far more sophisticated.

It has created a regulatory ecosystem designed to encourage responsible innovation while protecting consumers, preserving financial stability and combating financial crime.

This is significant for several reasons.

First, licensed businesses gain greater regulatory certainty.

Second, investors generally have greater confidence in regulated businesses than unlicensed operators.

Third, banks, institutional partners and payment providers are often more willing to work with businesses operating within a recognised regulatory framework.

Finally, entrepreneurs can now design products with greater confidence about the regulatory expectations that apply to them.

For founders planning to build long-term crypto businesses in East Africa, Kenya has become one of the most important jurisdictions to understand.

Chapter 2: Two Regulators—One Licensing Framework

One of the most common misunderstandings among founders is assuming there is only one crypto regulator.

There isn’t.

Kenya has adopted a dual-regulator model.

Depending on your activities, CBK vs. CMA: which regulator licenses your Kenya crypto business may be supervised by either the Central Bank of Kenya (CBK) or the Capital Markets Authority (CMA).

Understanding the difference is one of the most important decisions you will make before spending money on incorporation, technology or legal documentation.

The Central Bank of Kenya

Imagine you are building a crypto payments company.

Customers pay merchants in Bitcoin.

Merchants receive Kenyan shillings.

You provide hosted wallets.

Perhaps you even issue a stablecoin.

This business sits very close to Kenya’s payment system.

That is why it generally falls within the jurisdiction of the Central Bank of Kenya.

The CBK supervises activities such as:

• custodial wallet services;
• virtual asset payment processing; and
• stablecoin issuance.

These businesses typically handle customer assets, payment flows or digital money equivalents.

Because of that, the regulator places significant emphasis on financial stability, safeguarding customer assets, operational resilience and liquidity.

The Capital Markets Authority

Now imagine something different.

Instead of processing payments, your business helps people invest.

You operate:

• a crypto exchange;
• an OTC brokerage;
• an investment platform;
• a token launchpad;
• a tokenisation platform;
• a digital asset investment advisory business; or
• a virtual asset fund manager.

These businesses primarily deal with investment activity and capital formation.

Accordingly, they are generally supervised by the Capital Markets Authority.

The CMA focuses heavily on:

• investor protection;
• market integrity;
• disclosure;
• governance;
• fair dealing;
• transparency; and
• orderly markets.

Why This Matters

Many founders assume they only need to ask:

“Do I need a crypto licence?”

The better question is:

“Which regulator should license my business?”

Answering that question correctly at the beginning can save months of delay later.

Chapter 3: Kenya Doesn’t License Companies—It Licenses Activities

This is perhaps the most important concept in Kenya’s VASP framework.

Kenya does not license business names.

It licenses activities.

Let’s look at three founders.

Founder One

Sarah launches CryptoAfrica Ltd.

Her company provides secure custody of customer Bitcoin.

She believes she is simply running “wallet software.”

The regulator sees something different.

Sarah controls customer private keys.

She safeguards customer assets.

Her activity is custody.

She therefore requires the licence applicable to wallet providers.

Founder Two

Michael launches SwiftCrypto.

He never holds customer crypto.

Instead, he matches buyers and sellers and earns commission on completed trades.

He thinks he is merely operating a technology platform.

The regulator asks:

Who introduces the buyers?

Who matches the trades?

Who earns revenue from the transaction?

Michael’s answers determine whether his business falls within exchange or brokerage regulation.

Founder Three

Grace tokenises commercial real estate.

Investors purchase digital tokens representing ownership interests.

Grace believes she is “just digitising property.”

The regulator looks deeper.

The project involves tokenisation.

Potentially securities.

Potentially fundraising.

Potentially investment products.

The licensing analysis becomes significantly more sophisticated.

The lesson is simple.

Your marketing language does not determine your regulatory status.

Your actual activities do.

Chapter 4: Why Kenya’s Crypto Market Is Attracting Global Businesses

There is a reason international founders increasingly view Kenya as a strategic expansion market.

It goes far beyond regulation mentioned under Kenya’s 2026 crypto regulations and VASP guide.

Kenya combines several characteristics rarely found together.

A Digitally Connected Population

Kenya has spent years building one of Africa’s strongest digital-payment ecosystems.

Consumers are already comfortable using mobile financial services.

That familiarity creates an environment where digital assets are easier to understand and adopt.

Strong Entrepreneurial Culture

Walk through Nairobi’s innovation hubs and you’ll quickly notice something.

Builders are everywhere.

Software engineers.

FinTech founders.

Blockchain developers.

Artificial intelligence startups.

Tokenisation projects.

Digital-payment innovators.

Crypto businesses thrive where entrepreneurial communities already exist.

Kenya has one of the continent’s strongest.

Gateway to East Africa

Many international companies do not view Kenya as their final destination.

They see it as the gateway into:

• Uganda;
• Tanzania;
• Rwanda;
• Ethiopia;
• South Sudan; and
• the broader East African market.

Launching from Kenya often becomes the first step in a wider regional strategy.

Regulatory Maturity

Perhaps most importantly, Kenya has chosen regulation rather than prohibition.

For institutional investors, venture-capital firms and international banking partners, regulatory certainty is often worth far more than operating in an unregulated market.

A licence demonstrates that a business has undergone scrutiny regarding:

• governance;
• ownership;
• capital;
• technology;
• cybersecurity;
• compliance; and
• operational readiness.

That credibility can become a significant commercial advantage.

Chapter 5: Why Some Businesses Still Misunderstand the Law

Despite the new legislation, many founders still believe certain myths.

Let’s address a few.

Myth 1: “We’re incorporated overseas.”

Being incorporated outside Kenya does not automatically remove your business from Kenyan regulation.

If your company actively targets Kenyan customers or derives economic benefit from Kenya, the Kenyan framework may still apply.

Myth 2: “We never touch customer money.”

That alone may not determine the outcome.

Different regulated activities involve different risk profiles.

A business may trigger regulation because it:

• matches trades;
• facilitates transactions;
• manages portfolios;
• issues tokens; or
• provides investment advice.

Custody is important—but it is not the only licensing trigger.

Myth 3: “We call ourselves a technology company.”

Many crypto businesses describe themselves this way.

Regulators look beyond branding.

They examine:

• customer journey;
• transaction flow;
• revenue model;
• operational responsibilities;
• contractual arrangements; and
• actual business activities.

If those activities constitute regulated virtual asset services, changing the company description will not change the legal analysis.

Myth 4: “We’re still a startup.”

Early-stage businesses often believe licensing only matters once they become successful.

In reality, many regulatory obligations arise before launching services to customers.

Planning for licensing at the beginning is generally far easier—and significantly less expensive—than restructuring the business after launch.

Chapter 6: The Biggest Mistake Crypto Founders Make

Over the years, one mistake appears repeatedly across jurisdictions.

Founders spend months building technology.

They invest heavily in:

• software;
• user interfaces;
• marketing;
• tokenomics;
• fundraising;
• branding; and
• customer acquisition.

Only afterwards do they ask:

“Do we actually need a licence?”

By then, changing the business model may require:

• restructuring ownership;
• redesigning transaction flows;
• rewriting customer agreements;
• rebuilding technology;
• changing custody arrangements; and
• delaying launch by several months.

The better approach is to begin with the regulatory analysis.

Once you understand the licensing framework, every other business decision becomes easier.

Technology.

Governance.

Capital.

Compliance.

Marketing.

Fundraising.

All of them become aligned from the beginning.

That is exactly why sophisticated investors increasingly ask one question before committing capital:

“Is this business designed to operate legally?”

Coming Up in Part 2

Now that you understand why Kenya’s crypto licensing framework matters, the next question is even more practical:

• Which crypto businesses actually require a licence?
• How do you know whether your business falls within the law?
• What are the mandatory licensing requirements?
• How much capital do you really need?
• What documents must be prepared before you can apply?

In Part 2, we will answer each of these questions and walk through the licensing requirements step by step.

Part 2: Do You Need a Kenya Crypto Licence—and What Will It Take to Qualify?

Three weeks after James decided to pause his Kenyan launch, his team gathered around a conference table.

On the screen was a simple diagram showing how their platform worked:

1. A Kenyan customer deposited shillings.
2. The platform converted the money into a stablecoin.
3. The customer could hold the stablecoin in a hosted wallet.
4. The customer could exchange it for Bitcoin.
5. The platform earned a fee from every conversion.

The chief technology officer looked at the diagram and said:

“We are only providing software.”

The finance director disagreed.

“We are processing payments.”

The founder called it an exchange.

The product manager called it a wallet.

They were all partly correct.

That was the problem.

The company was not conducting one isolated activity. It was combining payment processing, custody and virtual asset trading within one customer journey.

This is where many founders become confused.

They assume they need only one general crypto licence in Kenya. In reality, Kenya regulates the individual activities performed by the business. A company may therefore require approval for one activity, several activities or a carefully restricted model designed to remain within a specific licence category.

Before preparing a Kenya VASP licence application, the business must first answer two questions:

What regulated activities are we carrying on?

Can we satisfy the legal, financial and operational requirements attached to them?

Chapter 7: Do You Actually Need a Crypto Licence in Kenya?

Do you need a crypto licence in Kenya? The starting rule is clear.

A person must not carry on, claim to carry on or hold itself out as carrying on virtual asset services in or from Kenya unless licensed by the relevant regulatory authority.

Eligible applicants must generally be companies limited by shares incorporated under Kenya’s Companies Act, or foreign companies limited by shares and registered under that Act.

The rule is broader than many offshore operators expect.

You may fall within the Kenyan regulatory perimeter even where:

• your company is incorporated outside Kenya;
• your servers are hosted abroad;
• you do not maintain a physical office in Nairobi;
• customer assets are held by a third-party custodian;
• settlement occurs through an overseas exchange; or
• your website describes the business as a technology platform.

The central issue is whether the business provides regulated services in or from Kenya, targets Kenyan consumers or derives income and economic benefit from the Kenyan market.

Signs That Your Business May Require a Kenya VASP Licence

A licensing assessment should be conducted where your company:

• accepts Kenyan residents as customers;
• supports Kenyan shilling deposits or withdrawals;
• advertises directly to people in Kenya;
• uses Kenyan influencers, agents or affiliates;
• facilitates crypto purchases or sales;
• earns commissions from Kenyan transactions;
• holds customer virtual assets or private keys;
• manages crypto portfolios;
• issues tokens to Kenyan investors;
• provides crypto payment services to Kenyan merchants; or
• operates a platform through which virtual assets are issued or traded.

Having a foreign licence does not automatically authorise the business to operate in Kenya.

A licence from Canada, Dubai, the European Union or another jurisdiction may demonstrate regulatory experience, but it does not replace the need to assess Kenyan law.

Chapter 8: Which Crypto Activities Are Regulated?

Kenya’s framework divides virtual asset services between the Central Bank of Kenya and the Capital Markets Authority.

The correct licence depends on what happens in the customer journey.

1. Custodial Wallet Services

Suppose your platform allows customers to deposit Bitcoin, Ethereum or stablecoins.

The customer sees a balance on the application, but your business or custody partner controls the private keys.

That arrangement may amount to custodial wallet activity.

A wallet provider may:

• hold private keys for customers;
• safeguard virtual assets;
• facilitate deposits and withdrawals;
• approve transactions;
• manage hot and cold wallets; or
• provide institutional custody.

Kenya crypto wallet licence requirements Custodial wallet providers fall under the Central Bank of Kenya.

A genuinely non-custodial wallet may be treated differently, particularly where users retain exclusive control over their keys. However, the legal analysis becomes more complicated where the provider controls recovery mechanisms, transaction approvals, smart-contract administration or the main customer interface.

2. Virtual Asset Exchanges

For starting a crypto exchange in Kenya, Imagine a platform displaying buy and sell prices for Bitcoin.

Customers place orders.

The platform matches those orders, executes trades and earns transaction fees.

That is likely to fall within virtual asset exchange activity.

An exchange may facilitate:

• fiat-to-crypto transactions;
• crypto-to-fiat transactions;
• crypto-to-crypto trading;
• order matching;
• clearing and settlement;
• operation of an order book; or
• other mechanisms through which virtual assets are exchanged.

Virtual asset exchanges fall under CMA supervision.

The regulator will scrutinise more than the trading interface. It may examine market surveillance, asset admission, custody, conflicts of interest, liquidity, settlement, market manipulation and customer disclosures.

3. Virtual Asset Brokerage

An OTC desk may not operate a public order book.

Instead, a customer requests to purchase a large quantity of USDT. The broker sources the asset from a liquidity provider, arranges the transaction and earns a spread or commission.

That may constitute virtual asset brokerage.

Brokerage risk may also arise where a business:

• introduces buyers and sellers;
• arranges off-market transactions;
• negotiates terms;
• receives customer orders;
• executes orders through another exchange;
• sources liquidity; or
• earns transaction-based compensation.

Calling the business an “introducer” does not necessarily remove the licensing requirement. The regulator will examine the degree of involvement and how the company earns money.

4. Virtual Asset Payment Processing

Consider a Kenyan travel company that wants to accept stablecoin payments.

A crypto payment provider receives the customer’s USDC, converts it and settles Kenyan shillings to the merchant.

Even where conversion or custody is outsourced, the company arranging the service may be carrying on virtual asset payment processing.

This category may cover:

• merchant crypto payment gateways;
• crypto-to-fiat settlement;
• fiat-to-crypto payment services;
• cross-border crypto payments;
• transaction routing; and
• payment collection involving virtual assets.

Virtual asset payment processors fall under CBK supervision.

5. Virtual Asset Investment Advice

A social media creator discussing Bitcoin generally is not automatically an investment adviser.

But the position changes where a business tells individual customers:

• which tokens to buy;
• when to sell;
• how much of their portfolio to allocate;
• which strategy suits their financial position; or
• which virtual asset product is appropriate for them.

Personalised or recommendation-based crypto advice may require a Virtual Asset Investment Adviser licence from CMA.

The words “not financial advice” will not resolve the issue where the substance of the service is clearly investment advice.

6. Virtual Asset Management

A business may require a Virtual Asset Manager licence where it exercises discretion over a client’s virtual asset portfolio.

For example, a customer deposits funds and authorises the manager to decide:

• which virtual assets to buy;
• when to rebalance;
• when to sell;
• how to allocate risk; and
• which investment strategy to follow.

The structure may also engage wider securities, collective investment scheme or fund-management laws.

7. ICOs, Tokenisation and Token Issuance Platforms

Kenya separately regulates key token-offering activities.

An initial coin offering provider may issue tokens to raise capital for a business, protocol or project.

A tokenisation provider may convert rights in real-world assets—such as property, commodities or receivables—into digital tokens.

A token issuance platform may operate infrastructure through which third-party issuers create, offer or distribute tokens.

Each model raises different legal questions relating to ownership rights, disclosure, valuation, investor protection, technology and secondary trading.

Merely calling the token a “utility token” does not determine its legal classification.

8. Stablecoin Issuance

A business that issues a token designed to maintain a stable value may require a Stablecoin Issuer licence from CBK.

This could include a token pegged to:

• the Kenyan shilling;
• the US dollar;
• another fiat currency;
• commodities; or
• a basket of reserve assets.

Stablecoin issuers face particularly demanding requirements because the stability promise depends on credible reserve management, custody, liquidity, redemption and disclosure arrangements.

Kenya’s regulatory structure assigns custodial wallets, payment processors and stablecoin issuance to CBK, while exchanges, brokers, investment advisers, managers, ICO providers, tokenisation providers and token issuance platforms fall under CMA.

Chapter 9: Activities That May Fall Outside the Licensing Regime

Not every blockchain project requires a Kenya VASP licence.

Some activities may fall outside the regime depending on their design.

These may include:

• personal buying and holding of crypto;
• pure software development;
• neutral blockchain infrastructure;
• certain non-custodial tools;
• closed-ecosystem tokens;
• qualifying service-access tokens;
• and certain non-financial NFTs.

However, founders should avoid relying on labels.

A token described as a loyalty point may become regulated if it is transferable, tradeable, redeemable for money or marketed as an investment.

An NFT described as digital art may require closer analysis if it represents investment rights, income, fractional ownership or an underlying financial asset.

A software provider may cross into regulated activity if it controls transactions, private keys, customer onboarding, asset selection or fee collection.

The legal position depends on functionality.

Chapter 10: What Must a Kenya VASP Applicant Prove?

Once the correct licence has been identified, the regulator will assess whether the applicant is fit to operate.

The application is not simply a registration exercise.

CBK or CMA may consider:

• the scale and complexity of the service;
• the underlying technology;
• the experience of the applicant;
• AML/CFT/CPF controls;
• data protection and internal safeguards;
• risks to customers and the financial system;
• net worth and source of funds;
• capital reserves;
• financial stability;
• innovation and consumer benefits;
• fitness and propriety of directors and senior officers; and
• fitness and propriety of beneficial owners.

In practical terms, the company must demonstrate that it is not merely incorporated—it is operationally credible through Kenya VASP licence requirements checklist.

Corporate Eligibility and Ownership

The applicant must have a transparent legal and ownership structure.

It should be able to identify:

• direct shareholders;
• ultimate beneficial owners;
• persons exercising control;
• group companies;
• significant shareholders; and
• the source of invested funds.

Complex offshore structures are not automatically prohibited, but every layer must be explainable and supported by documents.

Fit and Proper Management

Directors, the chief executive officer, senior officers, significant shareholders and beneficial owners may undergo fit-and-proper assessment.

The regulator may review:

• integrity;
• qualifications;
• relevant experience;
• competence;
• financial soundness;
• criminal history;
• regulatory history;
• insolvency;
• conflicts of interest; and
• capacity to perform the role.

A prestigious job title is not enough. Each officer should understand the business and be able to answer regulatory questions about their responsibilities.

Regulatory Business Plan

The business plan must tell the complete story of the proposed VASP.

It should cover governance, staffing, services, customer onboarding, technology, cybersecurity, risks, AML controls, financial projections, fees, safeguarding and implementation.

The prescribed business-plan structure also expects three-to-five-year projections and an explanation of anticipated customer numbers, transaction values and volumes.

Compliance Framework

A regulator-ready applicant should have policies addressing:

• AML/CFT/CPF;
• customer due diligence;
• sanctions;
• transaction monitoring;
• Travel Rule compliance;
• risk management;
• cybersecurity;
• data protection;
• consumer protection;
• complaints;
• conflicts of interest;
• outsourcing;
• market conduct;
• business continuity; and
• disaster recovery.

The policies must reflect the actual platform. A generic AML manual copied from an unrelated financial business will not adequately explain blockchain analytics, wallet screening or virtual asset transaction monitoring.

Technology and Cybersecurity

The applicant must also demonstrate that its systems are secure and resilient.

The final Regulations require technology documentation and independent assurance, including an information systems audit, vulnerability assessment and penetration testing.

The assessment may cover:

• system architecture;
• access controls;
• wallet infrastructure;
• key management;
• encryption;
• logging;
• transaction monitoring;
• backup systems;
• incident response;
• third-party integrations; and
• disaster recovery.

A licence application filed before the platform is ready for meaningful testing may encounter major delays.

Chapter 11: Capital Requirements—Where Ambition Meets Reality

James’s team became quiet when the capital table appeared on screen.

They had budgeted for lawyers, developers and marketing.

They had not budgeted for regulatory capital.

That omission could have ended the entire project.

Kenya’s minimum paid-up capital requirements vary significantly by activity.

Kenya VASP capital requirements – This capital is not a fee paid to the regulator.

It is shareholder capital maintained within the applicant company to support financial soundness.

However, founders should not assume the same money can fund every launch expense. The company must continue satisfying applicable capital and liquidity thresholds after paying salaries, technology costs and operating expenses.

Some licence categories also carry separate liquid-capital requirements. The required amount may be a fixed figure, a percentage of liabilities or the greater of the two.

Chapter 12: Regulatory Fees Are Only the Beginning

In addition to capital, applicants must pay statutory application and initial licence fees.

Yet these figures still do not represent the full cost of securing a Kenya crypto licence.

A complete budget should include:

• company formation;
• legal and regulatory advisory;
• senior management;
• compliance personnel;
• AML and blockchain-analytics systems;
• technology development;
• cybersecurity testing;
• external audit;
• insurance;
• premises;
• accounting;
• governance;
• and ongoing reporting.

The application fee may open the regulatory file.

It does not build the regulated business.

Chapter 13: The Moment James Understood the Real Question

After reviewing the activities, capital and licensing requirements, James leaned back and said:

“So the question is not whether Kenya will give us a licence.”

His lawyer nodded.

“What is the question?”

James looked again at the flowchart.

“Whether we are prepared to become the kind of business Kenya is willing to license.”

That is the right question for every founder.

A Kenya VASP licence is not merely permission to launch a website.

It is regulatory confirmation that the company has credible owners, capable management, adequate capital, secure technology and systems designed to protect consumers and the financial system.

Coming Up in Part 3

In the final part, we will take James’s company from planning to approval and examine:

• the Kenya crypto licence application process;
• the step-by-step licensing roadmap;
• the real cost of implementation;
• regulatory interviews and due diligence;
• common reasons applications fail;
• what happens after approval; and
• how CRYPTOVERSE can support an end-to-end Kenya VASP licence application.

Part 3: From Application to Approval—How to Secure and Maintain a Kenya Crypto Licence

When James first entered the meeting room, he thought the difficult part was over.

His company had identified the relevant licence categories. The shareholders were prepared to provide the required capital. The management team had agreed to establish a genuine operating presence in Kenya.

Then his legal adviser placed a document checklist on the table.

It ran for several pages.

There were corporate records, fit-and-proper forms, source-of-funds evidence, financial forecasts, cybersecurity reports, business rules, compliance policies, outsourcing agreements and customer-protection procedures.

James stared at the list.

“Do we really need all of this before applying?”

His adviser replied:

“You do not apply first and build the business later. You build a licence-ready business, then ask the regulator to approve it.”

That distinction defines Kenya’s VASP licensing process.

A successful application is not simply a well-written form. It is the final presentation of a business that has already been properly structured, capitalised, governed and prepared to operate.

Chapter 14: The Kenya Crypto Licence Application Process

A Kenya crypto licence application should be treated as a regulatory project with multiple interconnected workstreams.

Those workstreams typically include:

• corporate structuring;
• ownership and source-of-funds verification;
• management appointments;
• capitalisation;
• regulatory documentation;
• technology implementation;
• cybersecurity testing;
• AML/CFT/CPF systems;
• financial modelling; and
• engagement with the relevant regulator.

Trying to prepare these elements separately often creates contradictions.

For example, the business plan may say customer assets will be held by a third-party custodian, while the customer terms suggest the applicant itself will provide custody.

The financial projections may assume the business will earn trading spreads, while the licence application describes the company as a neutral introducer.

The technology diagram may show customer funds entering the applicant’s wallet, while the AML policy assumes transactions occur directly between customers and an external platform.

Regulators notice these inconsistencies.

A strong application tells one coherent story across every document.

Chapter 15: Step-by-Step Guide to Getting a Crypto Licence in Kenya

Step 1: Map Every Proposed Activity

Kenya crypto licence application process includes the first step is to create a detailed product and regulatory map.

The applicant should identify:

• what each customer can do;
• who holds customer fiat and virtual assets;
• who controls private keys;
• who receives and executes orders;
• who determines transaction prices;
• how settlement occurs;
• which third-party providers are involved;
• where revenue is earned; and
• which countries the business serves.

The output should be a clear activity matrix showing the relevant licence category for each product.

This step prevents a common mistake: applying for one licence while the platform performs several regulated activities.

Step 2: Determine Whether CBK, CMA or Both Are Relevant

The Central Bank of Kenya regulates custodial wallets, virtual asset payment processing and stablecoin issuance.

The Capital Markets Authority regulates exchanges, brokers, investment advisers, virtual asset managers, ICO providers, tokenisation providers and token issuance platforms.

A hybrid business may interact with both regulators.

For example, a platform may:

• provide hosted wallets;
• process crypto payments;
• facilitate virtual asset trading; and
• offer investment products.

The company should not assume that the broadest licence automatically covers everything. Each activity must be independently analysed.

Step 3: Incorporate or Register the Applicant

The applicant must have an eligible corporate form under Kenya’s Companies Act.

The licensing entity should have:

• transparent shareholders;
• identifiable beneficial owners;
• suitable directors;
• a principal place of business;
• clear constitutional documents;
• a corporate bank account;
• an appropriate business name; and
• a structure consistent with the proposed licence.

Where the applicant belongs to an international group, the regulator will expect a clear ownership chart showing the Kenyan entity, parent companies, affiliates and ultimate beneficial owners.

The structure should also explain where strategic decisions are made and how the Kenyan business will be governed.

Step 4: Finalise Shareholders and Source of Funds

The regulator will want to know who is funding the business and where that money came from.

The applicant should prepare documentary evidence supporting:

• shareholder wealth;
• investment funds;
• capital contributions;
• corporate income;
• asset sales;
• dividends;
• financing arrangements; and
• the movement of funds into the applicant.

Unexplained transfers, nominee arrangements and opaque ownership structures may delay or undermine the application.

The applicant should avoid temporary capital deposits made only to obtain a bank confirmation. Regulatory capital must be genuine and continuously available to support the business.

Step 5: Appoint Qualified Directors and Senior Officers

A crypto company cannot be regulated effectively if no one is genuinely responsible for its management.

The applicant should appoint directors and senior officers with relevant experience in areas such as:

• financial services;
• payments;
• virtual assets;
• technology;
• compliance;
• AML;
• cybersecurity;
• finance; and
• risk management.

The proposed chief executive officer, compliance officer, money laundering reporting officer and other control-function holders must understand the business.

During an interview, the regulator may ask:

• How are customer assets protected?
• Who approves new token listings?
• How are suspicious wallet transactions identified?
• What happens during a cybersecurity incident?
• Who monitors outsourced service providers?
• How will the company maintain regulatory capital?

An officer who cannot answer questions within their own area of responsibility may create serious concern.

Step 6: Capitalise the Business

The applicant must meet the prescribed paid-up and liquid-capital requirements for the relevant activity.

Capital planning should not stop at the statutory minimum.

A realistic model must also account for:

• salaries;
• technology subscriptions;
• premises;
• insurance;
• audits;
• professional fees;
• blockchain analytics;
• compliance systems;
• marketing;
• cybersecurity; and
• contingency reserves.

A company that meets the minimum capital requirement on the application date but falls below it immediately after launch may breach its licence conditions.

The financial model should therefore demonstrate ongoing solvency, liquidity and capital adequacy.

Step 7: Prepare the Regulatory Business Plan

The regulatory business plan is not a marketing document.

It must explain precisely how the business will operate.

A strong business plan should cover:

• the applicant’s background;
• ownership and group structure;
• proposed regulated activities;
• target customers;
• market opportunity;
• customer onboarding;
• transaction flows;
• custody and settlement;
• pricing and fees;
• governance;
• staffing;
• technology;
• outsourcing;
• AML and sanctions controls;
• consumer protection;
• financial forecasts;
• capital and liquidity; and
• the implementation timetable.

The business plan should also identify the key risks and explain how those risks will be managed.

Forecasts should be supported by realistic assumptions rather than exaggerated customer numbers designed to impress investors.

Step 8: Build the Mandatory Policy Framework

The applicant will need a comprehensive suite of policies and procedures.

These commonly include:

• AML/CFT/CPF policy;
• customer due diligence procedures;
• sanctions screening;
• transaction monitoring;
• Travel Rule procedures;
• enterprise risk management;
• cybersecurity;
• data protection;
• consumer protection;
• complaints handling;
• market conduct;
• conflicts of interest;
• outsourcing;
• business continuity;
• disaster recovery; and
• incident response.

Activity-specific policies may also be required.

An exchange may need:

• listing and delisting rules;
• market-surveillance procedures;
• order-execution rules;
• conflict controls; and
• customer asset safeguards.

A wallet provider may require:

• private-key management;
• hot and cold wallet controls;
• withdrawal authorisation;
• segregation procedures; and
• lost-access protocols.

A stablecoin issuer may require:

• reserve management;
• reserve custody;
• issuance and redemption;
• liquidity controls;
• independent verification; and
• wind-down procedures.

The policies must describe the actual systems the company will use.

Step 9: Complete Technology and Cybersecurity Testing

Crypto licensing is inseparable from technology risk.

Before filing, the applicant should have a sufficiently developed platform for independent review.

The technical workstream may include:

• information systems audit;
• vulnerability assessment;
• penetration testing;
• access-control testing;
• wallet-security review;
• private-key assessment;
• backup and recovery testing;
• incident-response testing; and
• review of outsourced infrastructure.

Any material weakness identified should be remediated before submission.

It is rarely helpful to present the regulator with a report containing unresolved critical vulnerabilities.

The applicant should also be ready to demonstrate the platform and explain how customer, transaction and compliance data moves through the system.

Step 10: Compile and Submit the Application

The application package should be indexed and organised into a regulatory data room.

It may include:

• prescribed application forms;
• certificate of incorporation;
• constitutional documents;
• ownership records;
• beneficial ownership information;
• fit-and-proper forms;
• police and regulatory clearances;
• business plan;
• financial projections;
• capital evidence;
• source-of-funds documents;
• audited or opening financial statements;
• policies and procedures;
• business rules;
• technology diagrams;
• cybersecurity reports;
• outsourcing agreements;
• material contracts;
• customer agreements; and
• proof of payment of the application fee.

The application fee is generally non-refundable.

Submitting an incomplete application to “start the clock” may not achieve the intended result. The substantive decision period generally depends on the regulator having received all required information and completed its due diligence.

Chapter 16: What Happens After Submission?

The application process does not end when the documents are filed.

In many cases, that is when the most demanding phase begins.

The regulator may:

• issue detailed information requests;
• question financial assumptions;
• request additional ownership evidence;
• interview directors and officers;
• contact overseas regulators;
• review shareholder backgrounds;
• ask for a platform demonstration;
• challenge outsourcing arrangements;
• require policy amendments;
• request proof of capital;
• examine customer asset flows; or
• require remediation before approval.

Responses must be accurate, coordinated and consistent.

A rushed answer from one department can contradict information submitted by another.

For that reason, the applicant should appoint a central licensing project manager responsible for:

• tracking regulatory questions;
• allocating responses;
• maintaining version control;
• checking consistency;
• collecting supporting evidence; and
• ensuring deadlines are met.

Material changes arising during the application should also be disclosed promptly.

These may include changes to:

• shareholders;
• beneficial owners;
• directors;
• senior management;
• capital;
• business activities;
• technology providers;
• financial condition; or
• cybersecurity status.

Chapter 17: Why Kenya VASP Applications Fail

James asked his adviser:

“What normally causes a regulator to reject an application?”

The adviser did not mention a single missing form.

Instead, he pointed to the business itself.

Most serious licensing problems come from weaknesses in the underlying model.

Unclear or Inconsistent Activities

The applicant says it is a broker, but its platform operates an exchange.

It says it is non-custodial, but it controls withdrawals.

It says it does not process payments, but all customer funds pass through its accounts.

These inconsistencies create doubt about whether management understands its own regulatory perimeter.

Weak Source-of-Funds Evidence

The regulator cannot verify where the capital originated or who truly controls it.

This is particularly risky where funding moves through multiple entities, individuals or crypto wallets without a clear audit trail.

Inexperienced Management

The company appoints impressive names who have little involvement in the business.

During interviews, the officers cannot explain the policies, systems or risks they are supposed to oversee.

Generic Compliance Documents

The policies read as though they were copied from a bank, securities firm or unrelated overseas VASP.

They do not address the applicant’s actual wallet structures, transaction flows or customer risks.

Immature Technology

The applicant describes a sophisticated platform, but the system is still a prototype.

There is no meaningful audit trail, security testing or operational evidence.

Unrealistic Financial Projections

The company forecasts millions of customers while budgeting for only a small compliance and customer-support team.

Revenue grows rapidly, but AML, cloud and cybersecurity costs remain static.

Insufficient Capital Planning

The company meets the initial capital threshold but lacks the funds required to operate for the first year.

The regulator may reasonably question whether the business is financially sustainable.

Chapter 18: The Real Cost of a Kenya Crypto Licence

The real cost of a Kenya crypto licence is not the application fee.

It is the cost of building a regulated institution.

The total budget may include:

The exact amount will depend on the licence category and operating model.

An investment advisory business may have a significantly lower cost base than an exchange, custodial wallet provider or stablecoin issuer.

However, even a licence category with no prescribed minimum paid-up capital still requires sufficient funding to operate responsibly.

A proper cost model should cover:

• licensing expenditure;
• at least 12 months of operating expenses;
• ongoing capital requirements;
• technology remediation;
• regulatory contingencies; and
• potential delays in revenue generation.

Chapter 19: Approval Is the Beginning, Not the End

Months after that first meeting, James’s company received approval.

The team celebrated.

Then the compliance officer reminded everyone:

“The licence allows us to begin. It does not allow us to relax.”

A licensed Kenya VASP must maintain continuous compliance.

Ongoing obligations may include:

• annual licence renewal;
• regulatory reporting;
• audited financial statements;
• minimum capital;
• AML monitoring;
• suspicious transaction reporting;
• sanctions compliance;
• cybersecurity testing;
• customer asset safeguarding;
• complaints handling;
• regulatory notifications;
• record keeping;
• training;
• outsourcing oversight; and
• approval for material changes.

A VASP licence is not a permanent certificate placed on the office wall.

It is a continuing regulatory relationship.

The business may need approval or notification before changing:

• ownership;
• directors;
• senior officers;
• business activities;
• control arrangements;
• critical systems;
• trade names;
• outsourcing;
• principal address; or
• customer asset arrangements.

The company must also commence its licensed activity within the prescribed period after approval.

Chapter 20: How CRYPTOVERSE Can Support Your Kenya VASP Application

Securing a Kenya crypto licence requires legal, financial, technical and operational coordination.

CRYPTOVERSE Legal Consultancy can support applicants with:

• regulatory perimeter assessments;
• CBK and CMA activity mapping;
• entity and ownership structuring;
• capital and liquidity planning;
• licensing-readiness assessments;
• business-plan preparation;
• financial projections;
• fit-and-proper applications;
• AML/CFT/CPF frameworks;
• governance and operational policies;
• customer and outsourcing agreements;
• coordination of cybersecurity workstreams;
• application preparation and submission;
• regulatory information requests;
• interview preparation;
• licence-condition closure; and
• post-licensing compliance.

The objective is not simply to produce documents.

It is to help build a business that is capable of obtaining—and keeping—the appropriate licence.

Conclusion: Kenya Is Open to Crypto, but Not to Regulatory Shortcuts

James did not succeed because he found a way around regulation.

He succeeded because he stopped treating regulation as an obstacle.

He treated it as part of the business model.

That decision changed everything.

His company redesigned its transaction flows.

It appointed qualified management.

It strengthened its technology.

It documented its source of funds.

It built real compliance systems.

By the time the application was submitted, the company was no longer merely an ambitious crypto startup.

It had become a credible regulated business.

That is the opportunity Kenya now presents.

The country has created a structured route for exchanges, brokers, wallet providers, payment processors, advisers, managers, tokenisation businesses, ICO providers, token issuance platforms and stablecoin issuers.

But the route is demanding.

Founders must understand that obtaining a Kenya crypto licence requires more than incorporation, a white-label platform or a well-designed website.

Our Kenya VASP licence guide requires:

• the correct licence;
• transparent ownership;
• adequate capital;
• fit-and-proper leadership;
• robust AML controls;
• secure technology;
• realistic financial planning;
• strong consumer protection; and
• continuing regulatory discipline.

For businesses willing to meet those standards, Kenya offers something valuable: a regulated entry point into one of Africa’s most dynamic digital economies.

For businesses looking for shortcuts, the risks are equally clear.

The most important question is therefore no longer:

“Can we launch a crypto business in Kenya?”

The real question is:

“Are we prepared to build the kind of crypto business Kenya is willing to license?”

Start Your Kenya Crypto Licensing Journey

Planning to launch a crypto exchange, wallet, payment platform, OTC desk, tokenisation project, investment business or stablecoin in Kenya?

CRYPTOVERSE can help you determine:

• whether a licence is required;
• which regulator and licence category apply;
• how much capital is needed;
• what the project will realistically cost;
• which documents must be prepared; and
• how to manage the application from structuring to approval.

Request a Kenya VASP Regulatory Perimeter and Licensing Readiness Assessment.

FAQs