Part 3: Capital, Regulatory Fees, Application Process, Timelines and Ongoing Compliance

Kenya VASP Licence: Complete Requirements, Costs, Capital and Application Process

In Parts 1 and 2, we examined two foundational questions.

First, what does the proposed crypto business actually do, and which Kenya VASP licence does it require?

Second, has the applicant built the ownership, governance, compliance, technology and consumer-protection framework needed to satisfy the regulator?

Part 3 addresses the commercial and procedural questions that founders usually ask next:

• How much capital is required?
• What are the application and licence fees?
• What is the real cost of obtaining a Kenya crypto licence?
• How is the application submitted?
• How long does the process take?
• Why are applications delayed or rejected?
• What obligations continue after approval?

These questions should not be considered only after the licence documents have been prepared.

Capital, liquidity, staffing, systems testing and ongoing compliance costs can materially affect whether the proposed business model is commercially viable.

A founder may have sufficient funds to pay the regulatory application fee but insufficient resources to capitalise the company, build the platform, appoint qualified management and maintain the business after approval.

The correct question is therefore not merely:

“How much does a Kenya VASP licence cost?”

It is:

“How much capital and operational funding will the company need to become licensed, launch successfully and remain compliant?”

1. Kenya VASP Minimum Paid-Up Capital Requirements

The Virtual Asset Service Providers Regulations, 2026 prescribe different minimum paid-up capital requirements for each regulated activity.

The capital threshold reflects, among other matters, the degree of financial, operational, custody and consumer risk associated with the activity. A stablecoin issuer or custodial wallet provider is therefore subject to a materially higher threshold than an investment adviser or broker.

These figures are minimum regulatory thresholds. They should not be treated as a complete measure of the amount required to launch the business.

What does paid-up capital mean?

Paid-up capital generally consists of ordinary shares that have been issued by the applicant and fully paid for by its shareholders.

For example, where a virtual asset broker must maintain KSh 10 million in paid-up capital, the applicant should be able to demonstrate that:

• the shares were validly issued;
• the shareholders genuinely paid for them;
• the funds were received by the applicant;
• the source of those funds is lawful and verifiable;
• the capital is recorded correctly in the company’s records and financial statements; and
• The money is not merely a temporary transfer intended to create the appearance of capitalisation.

The requirement cannot ordinarily be satisfied by issuing shares that remain unpaid.

It should also not be assumed that a repayable shareholder loan is equivalent to ordinary paid-up share capital.

Capital is not a regulatory fee

The capital is not paid to CBK or CMA as the price of the licence.

It remains within the licensed company and supports its financial resilience.

However, this does not mean the entire amount is freely available for immediate expenditure. The company must continue to meet the applicable capital and liquidity requirements after paying:

• salaries;
• technology costs;
• rent;
• audit fees;
• insurance;
• compliance expenses;
• service-provider charges; and
• other operational liabilities.

A business that injects only the statutory minimum and rapidly consumes it during launch may fall below the required threshold.

2. Liquid-Capital Requirements

Certain VASP categories are also subject to separate liquid-capital requirements.

Paid-up capital and liquid capital perform related but distinct functions.

Paid-up capital establishes the company’s equity base.

Liquid capital helps ensure that the business has sufficient readily available resources to meet liabilities and continue operating during stress.

The Regulations prescribe requirements including the following:

The applicable calculation should be confirmed for the applicant’s particular licence category and financial structure under the final Regulations.

Why liquid capital matters

Suppose a virtual asset exchange has the required KSh 100 million paid-up capital.

That does not necessarily mean the exchange has enough readily available funds to meet:

• customer claims;
• operational expenses;
• vendor payments;
• tax liabilities;
• staff costs;
• cyber-incident expenses; or
• short-term market disruption.

The regulator will therefore consider not only the amount of capital recorded in the company’s balance sheet but also:

• the quality of its assets;
• its liabilities;
• its cash position;
• the accessibility of funds;
• its projected expenditure; and
• the sustainability of its financial model.

Capital held in illiquid, volatile or encumbered assets may not provide the same level of protection as accessible cash or other acceptable liquid resources.

3. Capital Planning for Multiple VASP Activities

A company applying for several regulated activities should not assume that it only needs to satisfy the lowest capital requirement.

The relevant authority may consider:

• the highest applicable category;
• the combined risks of the activities;
• whether separate business lines are maintained;
• whether customer assets are held;
• the level of operational interdependence;
• the company’s liabilities;
• liquidity requirements; and
• any additional capital necessary to protect customers.

For example, a platform seeking authorisation to operate:

• an exchange;
• a custodial wallet; and
• a crypto payment processor

should not automatically plan around the KSh 10 million payment-processor threshold.

The custody and exchange elements create significantly greater financial and operational exposure.

The applicant should obtain a written capital assessment before finalising its fundraising target.

A practical capital formula

A serious applicant should budget for:

minimum paid-up capital + required liquid capital + licensing expenditure + pre-launch implementation costs + at least 12 months of operating runway + contingency reserve

This approach is more credible than capitalising the company at the precise statutory minimum and expecting future revenue to cover all ongoing expenses immediately after launch.

4. Kenya VASP Application and Initial Licence Fees

In addition to regulatory capital, an applicant must pay prescribed government fees.

The application fee is paid when the application is submitted. The initial licence fee is generally payable after approval and before the licence is issued.

The fee schedule and the broader licensing framework are contained in the final VASP Regulations.

Is the application fee refundable?

The application fee should generally be treated as non-refundable.

Where an applicant withdraws the application, the fee may be forfeited.

This is one reason the company should complete a licensing-readiness review before filing.

Submitting a premature application may lead to:

• loss of the application fee;
• repeated regulatory questions;
• extensive document revisions;
• reputational damage;
• withdrawal; or
• formal rejection.

5. The Real Cost of a Kenya VASP Licence

The regulatory fee is only a small part of the complete Kenya VASP licence cost.

A realistic budget should be divided into five workstreams.

5.1 Corporate establishment and structuring

Costs may include:

• Kenyan company incorporation;
• foreign company registration;
• beneficial ownership filings;
• shareholder agreements;
• constitutional documents;
• group restructuring;
• local office arrangements;
• tax registration; and
• corporate secretarial support.

5.2 Legal and regulatory preparation

This may include:

• regulatory perimeter analysis;
• licence-category mapping;
• corporate structuring;
• application drafting;
• regulatory business plan;
• governance framework;
• AML/CFT/CPF policies;
• consumer-protection documentation;
• outsourcing contracts;
• customer terms;
• fit-and-proper files;
• regulator correspondence; and
• management interview preparation.

5.3 Personnel

The applicant may need to recruit or engage:

• a chief executive officer;
• compliance officer;
• money laundering reporting officer;
• finance officer;
• risk officer;
• cybersecurity lead;
• internal auditor;
• operations personnel;
• customer-support staff; and
• market-surveillance personnel.

The required staffing structure will depend on the scale and complexity of the licence.

5.4 Technology and compliance systems

Potential costs include:

• platform development;
• cloud services;
• wallet infrastructure;
• private-key controls;
• KYC technology;
• sanctions screening;
• blockchain analytics;
• transaction monitoring;
• Travel Rule solutions;
• fraud monitoring;
• data protection;
• vulnerability assessments;
• penetration testing; and
• systems audits.

5.5 Post-licensing operations

Recurring expenses may include:

• annual licence renewal;
• external audit;
• cybersecurity audits;
• insurance;
• regulatory reporting;
• staff training;
• compliance monitoring;
• legal support;
• office costs;
• systems subscriptions; and
• capital maintenance.

The business should therefore prepare both:

• a licensing budget; and
• a post-authorisation operating budget.

6. Step-by-Step Kenya VASP Licence Application Process

Step 1: Conduct a regulatory perimeter assessment

The applicant should map every product and service.

This assessment should identify:

• each regulated activity;
• the responsible regulator;
• any requirement for multiple permissions;
• whether an exclusion applies;
• the role of outsourced service providers; and
• whether an offshore company is targeting Kenya.

The Virtual Asset Service Providers Act establishes the licensing framework and prohibits the unlicensed provision of regulated virtual asset services.

Step 2: Select and structure the applicant entity

The company should establish the correct legal vehicle and finalise:

• shareholding;
• beneficial ownership;
• group structure;
• board composition;
• management;
• local operations;
• technology ownership; and
• contractual relationships.

The applicant should be the entity that genuinely controls and carries on the regulated business.

Step 3: Complete a licensing-readiness review

A gap analysis should test whether the company is ready in relation to:

• capital;
• liquidity;
• governance;
• staffing;
• AML;
• cybersecurity;
• technology;
• custody;
• outsourcing;
• consumer protection;
• financial projections; and
• regulatory documentation.

The review should produce a remediation plan with assigned responsibilities and deadlines.

Step 4: Capitalise the company

The required equity should be injected into the applicant through a transparent and legally documented process.

The company should prepare:

• shareholder resolutions;
• share-allotment documents;
• updated registers;
• bank statements;
• source-of-funds evidence;
• financial statements; and
• any required confirmations from auditors.

Step 5: Appoint key personnel

The applicant should identify and appoint persons capable of performing the relevant control and management functions.

These individuals should be available for:

• due diligence;
• fit-and-proper review;
• regulator interviews;
• document approval;
• implementation; and
• post-licensing supervision.

Step 6: Prepare the application documents

The application package may include:

• prescribed forms;
• regulatory business plan;
• financial projections;
• fit-and-proper forms;
• source-of-funds evidence;
• corporate records;
• governance policies;
• AML framework;
• cyber and technology policies;
• consumer-protection policies;
• business continuity plan;
• customer agreements;
• outsourcing contracts;
• activity-specific business rules; and
• proof of capital.

Step 7: Complete technology assurance

The applicant should undertake:

• independent systems audit;
• vulnerability assessment;
• penetration testing;
• remediation;
• retesting; and
• final closure reporting.

Critical or high-risk findings should be addressed before submission.

Step 8: Submit the application

The completed application, supporting documents and application fee should be filed with CBK or CMA, depending on the activity.

Where the business falls within both mandates, the licensing strategy should be coordinated carefully.

Step 9: Respond to regulatory enquiries

The authority may request:

• additional documents;
• ownership clarification;
• source-of-funds evidence;
• revised policies;
• financial assumptions;
• platform demonstrations;
• cybersecurity evidence;
• management interviews;
• service-provider contracts; or
• changes to the proposed structure.

Responses should be:

• complete;
• consistent;
• properly approved;
• legally accurate; and
• delivered within the requested period.

Step 10: Regulatory determination

The final Regulations provide for determination within 30 days after the authority has received all required documents and information and completed its due diligence.

This is not necessarily 30 days from the date of the initial submission.

Step 11: Pay the initial licence fee

Where approval is granted, the applicant pays the applicable initial licence fee and satisfies any remaining conditions before the licence is issued.

Step 12: Implement and commence operations

The company should launch only the approved activities and comply with all licence conditions.

The final Regulations require the licensed business to commence its authorised activity within 12 months of the grant of the licence. 

7. How Long Does a Kenya VASP Licence Take?

There is no single practical timeline for every application.

The overall duration depends on:

• the licence category;
• the number of activities;
• ownership complexity;
• availability of capital;
• quality of source-of-funds evidence;
• recruitment of key personnel;
• platform readiness;
• cybersecurity findings;
• documentation quality;
• regulator questions; and
• the applicant’s response time.

A realistic project may be structured as follows:

Several workstreams can proceed in parallel.

However, an applicant should avoid rushing the filing merely to claim that the application has been submitted.

A poor-quality early submission may take longer than a well-prepared application filed several weeks later.

8. Common Reasons Applications Are Delayed or Rejected

The Regulations permit the regulator to reject an application in circumstances including where:

• the applicant fails to respond to requests for clarification;
• the applicant or relevant personnel fail to attend an interview;
• directors, senior officers or beneficial owners are not fit and proper;
• the applicant has a record of regulatory or AML non-compliance; or
• The proposed business creates unacceptable financial-stability risk.

In practice, the following weaknesses may also cause delay.

Wrong licence classification

The application seeks a broker licence, but the platform operates an exchange.

Unclear customer-asset flows

The applicant cannot clearly explain who holds fiat, crypto or private keys.

Opaque ownership

The regulator cannot identify the ultimate beneficial owners or understand the ownership structure.

Inadequate source-of-funds evidence

Capital is shown in the bank account, but its origin is not properly documented.

Nominal management

Directors or officers appear to have been appointed only for licensing purposes.

Generic policies

The policies do not reflect the platform, supported assets, customer profile or actual operational processes.

Weak technology

The platform is incomplete, cannot be demonstrated or contains unresolved security vulnerabilities.

Unrealistic projections

Revenue assumptions are aggressive, while staffing, compliance and technology expenditure are understated.

Insufficient operating runway

The company meets the minimum paid-up capital requirement but lacks sufficient additional funding to operate.

Contradictory documents

The application form, business plan, customer terms, financial model and website describe different services.

9. What Happens After the Kenya VASP Licence Is Issued?

Licensing creates a continuing supervisory relationship.

The VASP must maintain compliance with obligations relating to:

• capital and liquidity;
• governance;
• fit-and-proper status;
• AML/CFT/CPF;
• sanctions;
• Travel Rule compliance;
• cybersecurity;
• customer-asset safeguarding;
• complaints;
• market conduct;
• record keeping;
• audits;
• regulatory reporting;
• outsourcing;
• business continuity; and
• consumer protection.

Annual licence renewal

A VASP licence must be renewed annually.

The renewal application must be submitted at least two months before the licence expires. 

A licensed business should therefore maintain a standing renewal calendar covering:

• renewal deadlines;
• regulatory fees;
• audited accounts;
• capital evidence;
• cybersecurity reports;
• compliance confirmations;
• management changes; and
• outstanding regulatory matters.

Material changes

A licensee may need prior approval or notification before making material changes involving:

• ownership;
• beneficial ownership;
• control;
• directors;
• senior officers;
• regulated activities;
• business model;
• capital;
• custody;
• critical outsourcing;
• principal office;
• systems; or
• trade names.

The company should not treat regulatory approval as applying permanently to any future version of the business.

The licence is granted on the basis of the model and controls presented to the regulator.

10. Practical Market-Entry Strategy

A founder may be tempted to apply for every available activity to avoid future applications.

That approach can create unnecessary complexity.

A more practical strategy may involve three phases.

Phase 1: Establish the core regulated service

Launch only the activity central to the commercial model.

For example:

• brokerage;
• payment processing;
• investment advice; or
• tokenisation.

Phase 2: Build operational history

Demonstrate:

• regulatory compliance;
• customer protection;
• secure operations;
• adequate capital;
• reliable reporting; and
• management competence.

Phase 3: Apply for additional permissions

Once the business has established itself, it may consider adding:

• custody;
• exchange;
• payments;
• token issuance; or
• other services.

This phased approach may reduce initial capital, staffing and technology burdens.

However, the company must not conduct an activity before it has the relevant approval.

11. How CRYPTOVERSE Can Assist

A successful Kenya VASP licence application requires coordination between the founders, legal advisers, compliance professionals, finance team, technology team, auditors and cybersecurity specialists.

CRYPTOVERSE Legal Consultancy can assist with:

• regulatory perimeter assessments;
• CBK and CMA licence mapping;
• market-entry structuring;
• Kenyan applicant-company structuring;
• beneficial ownership review;
• capital and liquidity planning;
• source-of-funds preparation;
• licensing-readiness assessments;
• regulatory business plans;
• financial projections;
• fit-and-proper applications;
• governance frameworks;
• AML/CFT/CPF policies;
• sanctions and Travel Rule procedures;
• customer terms;
• consumer-protection policies;
• outsourcing agreements;
• activity-specific business rules;
• coordination of technology audits;
• application submission support;
• regulatory information requests;
• management interview preparation;
• approval-condition closure; and
• post-licensing compliance support.

The objective is not simply to file the application.

It is to help the applicant build a defensible and sustainable regulated business.

Conclusion: Licensing Is a Financial and Operational Commitment

A Kenya VASP licence should not be viewed as a certificate purchased by paying an application fee.

The application fee may be modest compared with the total commitment required.

The real licensing project involves:

• regulatory capital;
• liquid resources;
• transparent shareholders;
• qualified management;
• operational policies;
• AML systems;
• secure technology;
• customer-asset safeguards;
• cybersecurity testing;
• financial sustainability; and
• continuous compliance.

A founder should therefore determine, before applying:

1. which licence category applies;
2. which regulator is responsible;
3. how much paid-up capital is required;
4. whether separate liquid capital must be maintained;
5. how much working capital the company needs;
6. which personnel must be appointed;
7. whether the platform is ready for testing;
8. whether all required policies reflect the actual business;
9. how long the full licensing project is likely to take; and
10. how the business will remain compliant after approval.

Kenya’s VASP framework creates a clear entry route for exchanges, brokers, wallet providers, payment processors, investment businesses, tokenisation platforms and stablecoin issuers.

But access to the market is conditional on institutional readiness.

The businesses most likely to succeed will be those that do not ask only:

“What documents must we submit?”

They will ask:

“What kind of organisation must we become before the regulator can trust us with customers, assets and market access?”

FAQs