Do You Need a Crypto Licence in Kenya? A Regulatory Perimeter Guide for Crypto Businesses

How Exchanges, Wallets, OTC Desks, Payment Platforms, Token Issuers and Foreign Crypto Companies Can Determine Whether Kenya’s VASP Regime Applies

A founder launches a platform described as a “blockchain technology marketplace”.

Customers deposit Kenyan shillings, receive USDT, hold the USDT inside the application and exchange it for Bitcoin. The company does not call itself an exchange, custodian or payment processor. It describes itself as a software company connecting users to third-party liquidity providers.

Does it need a crypto licence in Kenya?

Very likely, the answer depends not on the company’s chosen label but on what happens behind the application.

The regulator will want to know:

• who contracts with the customer;
• who receives the Kenyan shillings;
• who controls the virtual asset wallet;
• who holds or can recover the private keys;
• who determines or communicates the exchange price;
• who executes or arranges the trade;
• who completes settlement; and
• who earns the fee, commission or spread.

These questions define the regulatory perimeter.

Kenya regulates virtual asset businesses under the Virtual Asset Service Providers Act, 2025, which commenced on 4 November 2025, together with the Virtual Asset Service Providers Regulations, 2026. The Act establishes the legal framework for licensing virtual asset service providers, while the Regulations operationalise the application, governance, capital, conduct and supervisory requirements.

This guide explains how to determine whether your crypto business requires a Kenya VASP licence, which regulator may supervise it and which business models may fall outside the licensing framework.

1. What Is a Regulatory Perimeter Assessment?

A regulatory perimeter assessment is a legal analysis of whether a proposed or existing business falls within a regulated activity.

For a crypto company, the analysis should identify:

1. every product and service offered;
2. the entities involved in delivering each service;
3. the movement of fiat currency and virtual assets;
4. the party controlling customer assets or private keys;
5. how transactions are arranged or executed;
6. the source of the company’s revenue;
7. the countries and customers being targeted; and
8. the regulatory permissions potentially required.

The assessment should be completed before the business:

• incorporates its licensing entity;
• builds its complete platform;
• signs long-term service-provider contracts;
• begins marketing in Kenya;
• accepts Kenyan customers; or
• raises capital based on a particular regulatory structure.

A late perimeter review can require the founders to redesign the product, separate business lines, change contractual arrangements or raise substantially more regulatory capital.

2. The Core Question: Are You Providing a Virtual Asset Service?

A company may require a Kenya crypto licence where it conducts a regulated virtual asset service commercially in or from Kenya.

The regulated framework covers business models involving activities such as:

• exchanging virtual assets for fiat currency;
• exchanging one virtual asset for another;
• transferring virtual assets;
• holding or managing customer virtual assets or private keys;
• arranging or executing virtual asset transactions;
• processing virtual asset payments;
• providing virtual asset investment advice;
• managing virtual asset portfolios;
• issuing or offering tokens;
• operating token issuance infrastructure;
• tokenising assets; and
• issuing stablecoins.

The Virtual Asset Service Providers Act establishes specific categories of regulated providers, including exchanges, brokers, wallet providers, payment processors, advisers, managers, tokenisation providers and token issuers.

The analysis is functional.

Calling a service “technology”, “consulting”, “facilitation”, “Web3 infrastructure” or “blockchain support” does not exclude it from licensing where the company performs the substance of a regulated activity.

3. Do Crypto Exchanges Need a Licence in Kenya?

A company will ordinarily require a crypto exchange licence in Kenya where it operates a digital platform that facilitates the buying, selling or trading of virtual assets.

An exchange may permit:

• Kenyan shillings to be exchanged for Bitcoin, Ether or stablecoins;
• virtual assets to be converted back into fiat currency;
• one virtual asset to be exchanged for another;
• buyers and sellers to submit orders;
• peer-to-peer transactions;
• instant conversions;
• request-for-quotation trading; or
• automated matching and settlement.

The regulatory analysis does not depend solely on whether the platform has a traditional public order book.

A business may still operate as an exchange where it:

• receives a customer’s purchase request;
• identifies a seller or liquidity source;
• purchases or receives the virtual asset;
• resells or delivers it to the customer; and
• earns a fee or spread.

The Act’s framework recognises virtual asset trading platforms that facilitate trading for compensation and may control customer assets or purchase assets following transaction matching. 

Example: Instant-buy platform

A customer selects “Buy Bitcoin”, deposits KSh 100,000 and receives a quoted amount of Bitcoin.

The platform sources the Bitcoin from a liquidity provider, adds a spread and credits the customer’s wallet.

Even without a visible order book, the platform may be performing exchange or brokerage activity. If it also holds the customer’s wallet, a separate custodial permission may be relevant.

4. Does an OTC Crypto Desk Need a Licence?

An OTC desk may require a virtual asset broker licence where it arranges, facilitates or executes transactions for customers.

Typical regulated indicators include:

• receiving instructions to buy or sell virtual assets;
• sourcing prices from liquidity providers;
• identifying counterparties;
• negotiating transaction terms;
• executing transactions for customers;
• handling fiat or crypto during settlement;
• charging a commission;
• adding a markup; or
• earning a spread between the customer price and liquidity-provider price.

“We only introduce the parties”

A pure introduction may present a different regulatory profile from executing or arranging a transaction.

However, the company should examine whether it does more than provide contact details.

The activity becomes more likely to fall within regulation where the introducer:

• collects the customer’s order;
• communicates transaction quantities and prices;
• negotiates terms;
• coordinates payment;
• instructs the transfer;
• confirms settlement;
• handles disputes; or
• receives transaction-based compensation.

A business cannot necessarily avoid licensing by inserting an offshore exchange or liquidity provider into the transaction chain.

The relevant question is what role the customer-facing company actually performs.

5. Do Crypto Wallet Providers Need a Licence?

A provider may require a virtual asset wallet provider licence where it holds, safeguards or manages virtual assets or private keys for customers.

The Act recognises custodial wallet services involving a third party that holds or manages private keys. 

Regulated wallet services may include:

• hosted retail wallets;
• institutional custody;
• hot-wallet management;
• cold storage;
• multi-signature custody;
• deposit and withdrawal administration;
• transaction authorisation;
• private-key storage; and
• wallet recovery.

The custody test

The central question is control.

Ask whether the provider can:

• access the virtual assets;
• authorise or reject a transaction;
• suspend withdrawals;
• recover the wallet;
• reconstruct the private key;
• alter signing permissions;
• move funds during an emergency;
• reset account credentials in a way that restores asset access; or
• exercise administrative control over a smart contract.

Where the provider has meaningful control, the wallet may be custodial even if it is marketed as “decentralised” or “self-custody”.

When a non-custodial wallet may fall outside custody licensing

A genuinely non-custodial software provider may have a stronger argument that it is not providing custodial wallet services where:

• private keys are generated and held solely on the user’s device;
• the provider never receives the keys or seed phrase;
• the provider cannot recover the wallet;
• transactions require only the user’s independent authorisation;
• the provider cannot freeze or redirect assets; and
• the software does not independently execute other regulated services.

However, additional features may change the analysis. A non-custodial wallet that integrates swaps, fiat on-ramps, brokerage, staking or payment processing may still engage other regulated activities.

6. Do Crypto Payment Businesses Need a Licence?

A company may require a virtual asset payment processor licence where it facilitates payments involving fiat currency and virtual assets or routes virtual asset payments between customers, merchants and other service providers.

Potentially regulated business models include:

• merchant crypto-payment gateways;
• stablecoin payment platforms;
• crypto remittance applications;
• fiat-to-crypto on-ramps;
• crypto-to-fiat off-ramps;
• payment collection;
• virtual asset payment routing; and
• merchant settlement services.

Example: Merchant payment gateway

A Kenyan merchant displays a QR code allowing customers to pay in USDT.

The payment platform:

1. receives the payment instruction;
2. verifies the transfer;
3. arranges conversion through a liquidity provider;
4. settles Kenyan shillings to the merchant; and
5. charges a processing fee.

The company may be providing regulated virtual asset payment processing even if the conversion and custody functions are outsourced.

The analysis should identify:

• who contracts with the merchant;
• who promises settlement;
• who controls the payment interface;
• who manages failed payments;
• who handles refunds;
• who bears settlement risk; and
• who receives the processing fee.

7. Do Crypto Investment Advisers Need a Licence?

A company may require a virtual asset investment adviser licence where it provides recommendations or advice concerning virtual assets.

Potentially regulated services include:

• personalised recommendations to buy, sell or hold tokens;
• crypto portfolio allocation advice;
• suitability assessments;
• recommendations based on a customer’s financial circumstances;
• advice concerning token offerings;
• paid research tailored to a particular customer; and
• automated recommendations generated from customer data.

General education versus personalised advice

Publishing general information about Bitcoin or blockchain technology is not necessarily the same as advising a particular customer.

The risk of licensing increases where the service:

• collects information about the customer’s financial position;
• assesses risk appetite;
• recommends particular assets;
• tells the customer when to enter or exit a position;
• receives a fee for the recommendation; or
• receives compensation linked to the customer’s investment.

A disclaimer stating “this is not financial advice” will not determine the legal classification where the service is personalised investment advice in substance.

8. Do Crypto Asset Managers Need a Licence?

A virtual asset manager generally makes investment decisions on behalf of a customer.

The manager may decide:

• which virtual assets to purchase;
• how much to allocate;
• when to trade;
• when to rebalance;
• when to sell; and
• which strategy to follow.

Potentially regulated models include:

• discretionary managed accounts;
• crypto portfolio management;
• algorithmic portfolio-management services;
• institutional digital asset mandates; and
• certain managed crypto investment products.

The distinction between advice and management is authority.

An adviser recommends. The customer decides.

A manager has discretion to act within an agreed mandate.

Depending on the legal structure, a managed crypto investment product may also engage securities, collective investment scheme, custody or capital markets regulation beyond the VASP licence.

9. Do Token Issuers and ICOs Need a Licence?

A company that issues and sells virtual assets to the public may fall within the initial coin offering or token issuance framework.

The Act expressly identifies initial coin offering activity involving the issuance and sale of virtual assets to the public.

Licensing or regulatory approval may be relevant where a project:

• raises capital by selling tokens;
• offers tokens to Kenyan investors;
• promises access to future products or revenues;
• operates a token launch;
• accepts fiat or crypto subscriptions;
• offers tokens with financial or investment characteristics; or
• arranges admission of the tokens to trading.

“It is only a utility token”

Calling a token a utility token does not settle the issue.

The analysis should consider:

• whether the product or service already exists;
• whether the token is transferable;
• whether it can be traded;
• whether it can be redeemed;
• whether purchasers expect an increase in value;
• whether token-sale proceeds fund development;
• whether the token represents rights to profits, assets or income; and
• how the token is marketed.

A token promoted primarily as an opportunity to profit is likely to attract more regulatory scrutiny than a genuinely limited-access digital voucher.

10. Do Tokenization Businesses Need a Licence?

Tokenization involves creating digital tokens that represent rights in an underlying asset or arrangement.

Examples may include tokenisation of:

• real estate;
• commodities;
• precious metals;
• receivables;
• private company shares;
• intellectual property;
• art;
• revenue streams; and
• contractual rights.

A tokenisation provider may require a VASP licence, but the analysis does not end there.

The project may also engage the law governing the underlying asset.

For example, real estate tokenisation may involve:

• land law;
• company law;
• trust or special-purpose vehicle arrangements;
• securities regulation;
• collective investment rules;
• investor disclosures;
• valuation;
• custody;
• tax;
• insolvency; and
• restrictions on transferring property interests.

A VASP authorisation does not automatically cure a defective ownership or investment structure.

11. Do Token Launchpads Need a Licence?

A token issuance platform provides infrastructure through which third-party issuers create, offer, distribute or sell virtual assets.

Examples include:

• launchpads;
• token subscription portals;
• primary token marketplaces;
• digital issuance platforms; and
• investor onboarding platforms.

A platform may perform regulated functions where it:

• reviews or admits issuers;
• conducts issuer due diligence;
• publishes offering information;
• onboards investors;
• receives subscription funds;
• distributes tokens;
• facilitates settlement;
• charges fundraising fees; or
• arranges subsequent trading.

The platform cannot necessarily avoid regulation by stating that the third-party project is solely responsible for the token.

Its own gatekeeping, onboarding, transaction and distribution functions must be analysed separately.

12. Do Stablecoin Issuers Need a Licence?

A company issuing a token designed to maintain a stable value may require a stablecoin issuer licence.

The token may seek to maintain value by reference to:

• the Kenyan shilling;
• another fiat currency;
• commodities;
• other virtual assets; or
• a basket of assets.

The regulatory analysis should examine:

• who legally issues the stablecoin;
• what reserves support it;
• where reserves are held;
• who owns the reserve assets;
• whether holders have redemption rights;
• how redemption occurs;
• how stability is represented to the public;
• who manages minting and burning;
• whether interest or returns are offered; and
• whether the token is marketed in Kenya.

Using a token issued by an independent third party is different from legally issuing the stablecoin. However, a business distributing, exchanging, holding or processing payments in that stablecoin may still require another form of VASP licence.

13. Do Blockchain Developers Need a Licence?

Developing software does not automatically require a VASP licence.

A developer may fall outside the perimeter where it merely:

• writes code;
• designs a blockchain;
• provides cybersecurity services;
• develops smart contracts;
• supplies software to a regulated entity;
• provides infrastructure without controlling transactions; or
• offers technical support.

However, the position changes where the developer also:

• controls the deployed protocol;
• retains administrative keys;
• executes transactions;
• controls customer assets;
• receives customer orders;
• provides a user-facing exchange;
• charges transaction-based fees;
• determines which tokens are available; or
• operates the service after development.

The regulator will distinguish a neutral technology supplier from the actual operator of a virtual asset service.

White-label platforms

A white-label arrangement deserves particular scrutiny.

Where a Kenyan company uses software supplied by an overseas provider, the parties should determine:

• who contracts with customers;
• who controls onboarding;
• who operates the interface;
• who holds private keys;
• who controls liquidity;
• who approves withdrawals;
• who handles complaints;
• who receives transaction fees; and
• who can change the platform’s rules.

The licence should sit with the entity genuinely responsible for the regulated activity, not merely the company whose brand appears on the application.

14. Do Crypto Miners or Validators Need a Licence?

Mining, validating or supporting a blockchain network does not necessarily amount to providing a regulated virtual asset service to customers.

A person operating computing infrastructure may be outside the VASP perimeter where they do not:

• exchange assets for customers;
• hold customer keys;
• arrange transactions;
• provide payment services;
• manage customer investments; or
• issue regulated tokens.

However, additional commercial functions must be assessed separately.

For example, a mining company may require further analysis where it:

• operates a hosted mining investment scheme;
• receives customer funds to acquire mining equipment;
• promises fixed returns;
• manages crypto portfolios;
• sells fractional rights to mining revenue;
• holds customer mining rewards; or
• issues tokens linked to mining income.

The regulatory outcome depends on the complete arrangement, not the presence of mining technology.

15. Are NFTs Regulated in Kenya?

Not every non-fungible token necessarily falls within Kenya’s VASP framework.

The Act contains exclusions for specified digital representations, including certain non-financial NFTs and qualifying closed-ecosystem or service tokens. 

A simple digital collectible may present a different regulatory profile from an NFT that represents:

• fractional property ownership;
• profit rights;
• entitlement to rental income;
• a debt claim;
• access to an investment pool;
• rights to redeem an underlying commodity; or
• an instrument marketed for investment.

The label “NFT” is not decisive.

The analysis should consider its functionality, transferability, economic rights and marketing.

16. Are Loyalty Points and In-Game Tokens Regulated?

A closed-loop loyalty point or in-game token may fall outside the VASP framework where it is genuinely restricted to a closed ecosystem.

The Act recognises concepts including a closed ecosystem and virtual service tokens that are not transferable or exchangeable with third parties. 

A stronger case for exclusion may exist where the digital value:

• can only be used with the issuing merchant or platform;
• cannot be transferred between unrelated users;
• cannot be exchanged for fiat or crypto;
• cannot be traded on external markets;
• cannot be redeemed for cash;
• is not marketed as an investment; and
• provides only access to goods or services.

The position may change where the token becomes:

• externally transferable;
• tradable;
• convertible;
• redeemable;
• accepted by multiple unrelated merchants; or
• promoted as capable of increasing in value.

A closed ecosystem can become an open financial network through product expansion.

17. Does Personal Crypto Investing Require a Licence?

An individual ordinarily does not require a VASP licence merely because they:

• purchase virtual assets for personal investment;
• hold Bitcoin in a private wallet;
• transfer personal assets;
• sell part of their own portfolio; or
• use virtual assets personally.

Licensing concerns arise when a person begins providing regulated services commercially to others.

For example, the risk changes where the person:

• regularly buys crypto for other people;
• holds customer funds;
• charges a commission;
• operates an OTC desk;
• manages other people’s portfolios;
• receives money for investment in crypto;
• safeguards assets for customers; or
• advertises trading services to the public.

A person cannot avoid regulation indefinitely by describing a recurring customer business as personal trading.

18. Can Outsourcing Remove the Need for a Licence?

Not necessarily.

A company may outsource:

• custody;
• trade execution;
• KYC;
• payment processing;
• blockchain analytics;
• liquidity;
• settlement; or
• technology.

But outsourcing does not automatically remove the customer-facing entity from regulation.

The assessment should ask:

• who offers the service;
• who signs the customer agreement;
• who controls the customer journey;
• who receives the order;
• who promises the outcome;
• who bears responsibility for failure;
• who handles complaints; and
• who receives the economic benefit.

Example: Crypto purchase application

A startup allows customers to submit Kenyan shillings and purchase Bitcoin. A foreign licensed exchange executes the trade.

The startup may still be regulated if it:

• markets the purchase service;
• onboards the customers;
• receives their instructions;
• arranges the payment;
• communicates the exchange price;
• coordinates delivery; and
• charges the customer.

The foreign exchange’s licence does not automatically extend to the Kenyan startup.

19. Does an Offshore Crypto Company Need a Kenya Licence?

Potentially, yes.

Kenya’s Regulations are relevant not only to locally incorporated businesses but also to businesses offering virtual asset services in or from Kenya. The final framework captures companies that actively solicit or target Kenyan consumers or derive economic benefit or income from Kenya, even without a physical presence. 

Indicators of Kenyan market targeting may include:

• accepting Kenyan residents;
• offering Kenyan shilling payment methods;
• using mobile-money integrations;
• running Kenyan advertising campaigns;
• using Kenyan influencers or affiliates;
• creating Kenya-specific promotional offers;
• employing Kenya-focused sales staff;
• partnering with local merchants; or
• generating fees from Kenyan users.

Passive accessibility versus active targeting

A website merely being visible in Kenya may present a different case from actively pursuing Kenyan customers.

The analysis should consider the full circumstances, including:

• onboarding restrictions;
• supported countries;
• local currency support;
• payment methods;
• marketing;
• customer-support arrangements;
• contractual wording; and
• actual Kenyan customer activity.

A disclaimer stating that services are not offered in Kenya will carry little weight if the platform actively accepts Kenyan customers and supports local payment channels.

20. Regulatory Perimeter Decision Table

This table is indicative. A formal assessment must consider the facts of the particular business.

21. A Five-Step Self-Assessment

Step 1: Identify the service

Write down what the customer can actually do—not how the company markets itself.

Step 2: Map control

Identify who controls money, virtual assets, private keys, orders, pricing and settlement.

Step 3: Follow the revenue

Determine whether the company earns a subscription, commission, transaction fee, listing fee, management fee or spread.

Transaction-linked revenue is often an important indicator of the company’s functional role.

Step 4: Identify the market

Confirm whether the company is incorporated in Kenya, operates from Kenya, targets Kenyan consumers or earns income from Kenyan users.

Step 5: Match the activity to the regulator

Determine whether the service falls under:

• CBK;
• CMA;
• both authorities; or
• a genuine statutory exclusion.

Where the outcome is uncertain, obtain a written regulatory perimeter opinion before launch.

22. Risks of Getting the Perimeter Wrong

Operating a regulated virtual asset service without the required licence may expose the company and its controllers to:

• regulatory enforcement;
• orders to stop operating;
• financial penalties;
• criminal or administrative consequences;
• restrictions on banking and payment relationships;
• termination by service providers;
• customer claims;
• reputational damage;
• difficulties obtaining a future licence; and
• scrutiny of directors, shareholders and beneficial owners.

The risk is not limited to companies openly describing themselves as exchanges or wallets.

An incorrectly structured software, brokerage, token or payment model can still fall within regulation.

The company should also avoid presenting itself as:

• licensed;
• regulated;
• approved;
• authorised; or
• awaiting only a routine approval

unless those statements are accurate and appropriately qualified.

23. When Should You Obtain a Formal Perimeter Opinion?

A written legal assessment is particularly important where:

• the business combines several crypto services;
• the platform uses a white-label provider;
• customer assets move through third-party wallets;
• the wallet is described as non-custodial but has recovery features;
• the company only introduces customers to liquidity providers;
• the token is described as a utility token;
• NFTs represent financial or ownership rights;
• the project involves real-world asset tokenisation;
• the company is based offshore but targets Kenya;
• a decentralised protocol retains administrative controls;
• services are split between several group companies; or
• the business relies on a statutory exclusion.

A perimeter opinion should set out:

• the factual business model;
• transaction and funds flows;
• relevant legal definitions;
• potentially regulated activities;
• applicable exclusions;
• the likely regulator;
• the required licence categories;
• structural risks; and
• recommended remediation.

How CRYPTOVERSE Can Help

CRYPTOVERSE Legal Consultancy can assist crypto businesses in determining whether they require a licence in Kenya and how the business should be structured before application.

Our regulatory perimeter support may include:

• product and activity mapping;
• customer-journey analysis;
• fiat and virtual asset flow mapping;
• custody and private-key assessments;
• CBK and CMA jurisdiction analysis;
• exchange-versus-broker classification;
• payment-processing analysis;
• non-custodial wallet assessments;
• foreign-company market-access reviews;
• token and stablecoin classification;
• NFT and closed-ecosystem analysis;
• tokenisation structuring;
• outsourcing and white-label assessments;
• written legal opinions;
• licence-category recommendations;
• applicant-entity structuring; and
• end-to-end Kenya VASP licensing support.

The purpose of the exercise is not merely to answer “yes” or “no”.

It is to identify the safest and most commercially practical route into Kenya’s regulated virtual asset market.

Conclusion: Your Business Model Determines the Answer

Whether you need a crypto licence in Kenya cannot be determined solely from your company name, website description or technology stack.

The correct answer depends on:

• what the customer can do;
• what your company controls;
• how fiat and virtual assets move;
• who holds the private keys;
• who arranges or executes transactions;
• how your company earns revenue;
• whether Kenyan customers are targeted; and
• whether a genuine exclusion applies.

A company described as a software provider may, in substance, operate a crypto exchange.

A non-custodial wallet may include features that amount to brokerage or payment processing.

An offshore platform may fall within the Kenyan perimeter because it actively targets and earns income from Kenyan customers.

A loyalty point may begin outside regulation and become a regulated virtual asset when it becomes transferable, tradable or redeemable.

The perimeter is therefore not static.

It must be reviewed whenever the business introduces:

• a new product;
• a new token;
• custody;
• fiat payment functionality;
• merchant settlement;
• investment recommendations;
• portfolio management;
• token issuance;
• new customer jurisdictions; or
• a different revenue model.

The safest approach is to settle the regulatory classification before launch—not after the platform has accepted customers and begun processing transactions.

FAQs