Kenya VASP Licence 2026: What Crypto Exchanges, Wallets and Stablecoin Issuers Need Now the Transition Has Ended

What changes on 4 November 2026

Kenya's Virtual Asset Service Providers Act 2025 (Act No. 20 of 2025) was gazetted on 21 October 2025 and came into force on 4 November 2025. It gave businesses already offering virtual asset services one year to obtain a licence. That year ends on 4 November 2026. From that date every exchange, broker, custodial wallet, crypto payment processor and stablecoin issuer serving Kenya needs a licence from the Central Bank of Kenya (CBK) or the Capital Markets Authority (CMA), and a new entrant must be licensed before it starts.

Licensing could not begin until the detailed rules existed. The CBK said so in its public notice of 18 November 2025, adding that neither regulator had yet licensed any provider under the Act. The National Treasury gazetted the Virtual Asset Service Providers Regulations 2026 on 22 July 2026 as Legal Notice No. 134 of 2026, which set out the licence categories, capital, documents and conduct rules. Firms therefore had a little over three months to prepare an application before the transition closed.

Kenya is the first East African market with a complete licensing regime for crypto platforms and stablecoin issuers. For firms already serving Kenyan customers, the question is no longer whether to apply but which regulator, which category and how quickly a complete file can be lodged.

Key dates from the Act to licensing

The regime arrived in three steps, and the dates explain why most applications are being lodged now rather than a year ago.

New entrants never had a transition: since 4 November 2025 they have needed a licence before starting, and since July 2026 they have had a set of rules to apply under.

Who needs a Kenyan VASP licence

The Act and the Regulations apply to virtual asset services provided in or from Kenya. Law firm summaries of the Regulations read this to include a foreign provider that actively targets Kenyan customers or earns revenue from Kenya, even with no office or staff there. A global exchange that markets to Kenyan users, offers Kenyan shilling payment methods or lists M-Pesa as a funding route should plan on the basis that it is in scope.

The services covered are those listed in the First Schedule to the Act:

• exchanging virtual assets for money or for other virtual assets, and operating a trading platform;
• brokering and dealing for clients;
• holding virtual assets or private keys for clients in a custodial wallet;
• processing payments in virtual assets for merchants and users;
• issuing stablecoins;
• advising on and managing virtual asset portfolios;
• running initial coin offerings, tokenising real-world assets and operating token issuance platforms.

A business with more than one activity needs a licence for each, from the regulator responsible for that activity.

CBK or CMA: which regulator licenses your activity

The Act divides supervision by activity. Payment-type and money-like services go to the central bank; investment and market services go to the capital markets regulator.

A typical retail crypto app with an exchange, a custodial wallet and a shilling on and off ramp therefore deals with both regulators: the CMA for the exchange and the CBK for the wallet and payment processing. The two run separate application processes, so the files should be prepared together and kept consistent on ownership, systems and AML controls.

Capital requirements for each licence

The Regulations set a minimum paid-up capital for each category. The figures below are those reported consistently by Kenyan law firms reviewing Legal Notice No. 134 of 2026; applicants confirm the current figure with the regulator before injecting capital.

Where one company holds more than one licence, it must hold the capital for its highest category plus 50% of the paid-up capital for each additional activity. An exchange that also runs custodial wallets, for example, holds KES 150 million for the wallet licence plus 50% of KES 100 million for the exchange, a total of KES 200 million.

Paid-up capital is only the entry point. The Regulations add liquid capital, insurance and continuing financial requirements, so the business plan should show how capital holds up through the first three years of trading, including the cost of the systems audit, security testing and compliance staff the regulators expect.

Stablecoin issuers: what the Central Bank of Kenya expects

Stablecoin issuance carries the highest capital in the regime and sits with the CBK. Law firm summaries of the Regulations report that a fiat-referenced stablecoin issuer must hold:

• paid-up capital of KES 300 million;
• liquid capital of the higher of KES 60 million and 100% of current liabilities for at least 30 days;
• reserves that fully back the coins in issue;
• a redemption process that generally pays holders at par within two working days.

These rules follow the pattern of other issuer regimes: full reserves, held apart from the issuer's own money, and redemption at face value. The Kenyan position on interest to holders, reserve composition and reporting should be read from the Regulations themselves before a reserve structure is fixed.

For a global issuer, Kenya is one more market where a local licence is needed to issue or actively offer a coin. Our comparison of stablecoin licences by country sets the Kenyan rules beside the UK, EU, US, Hong Kong and UAE regimes, and the stablecoin issuer tracker lists the issuers regulators have already licensed.

The application file

The Regulations list what an application must contain. The file is close to a payment institution or investment firm application in other markets, with additional technology evidence.

The regulator decides whether an application is complete within 30 days. That clock runs only once the file is whole, so missing policies or an audit that is still in progress delay everything that follows. Coin offerings need CMA approval and a white paper before any offer or promotion.

Local entity, board and AML

Applicants are expected to apply through a Kenyan company. Kenyan law firms report governance expectations of at least three directors, with at least one third independent, and separate chair and chief executive roles. Firms already serving Kenya from abroad may need to incorporate locally and move the Kenyan customer relationship into the new entity.

The Act sets anti-money laundering, counter-terrorist financing and proliferation financing obligations for licensed providers. In practice that means customer due diligence, transaction monitoring, suspicious transaction reporting to Kenya's Financial Reporting Centre and the travel rule for transfers. A group AML programme can be reused, but it needs a Kenyan annex: the local reporting route, the money laundering reporting officer for the Kenyan entity, and the risk assessment of Kenyan products such as mobile money funding.

What to do now the transition has ended

The steps depend on where a firm stands on 4 November 2026.

1. Map each service to a category and regulator. Most platforms need at least one CBK and one CMA licence.
2. Decide the entity and capital. Incorporate in Kenya if needed and plan capital using the highest category plus 50% for each additional one.
3. Commission the technology evidence. The independent systems audit and penetration test take the longest to arrange, so they start first.
4. Adapt the policies. Group policies need a Kenyan annex for AML, complaints, consumer protection and data protection.
5. Talk to the regulators. The CBK takes questions at [email protected] and the CMA at [email protected]. Confirm whether current Kenyan activity can continue while an application is considered, and record the answer.
6. Review marketing. Until licensed, stop promotions aimed at Kenyan users that the regulators could treat as providing services in Kenya.

How Buckingham Capital Consulting supports Kenya market entry

We prepare CBK and CMA applications as one programme: category mapping, entity and capital planning, the business plan, the policy set with its Kenyan annexes, and coordination of the systems audit and penetration test. For stablecoin issuers we build the reserve, redemption and liquid capital model the CBK reviews. Our stablecoin licensing practice and crypto licensing guide cover the other markets most Kenyan applicants also serve, including South Africa.

Frequently asked questions

References

1. Virtual Asset Service Providers Act 2025 (Act No. 20 of 2025)
2. Central Bank of Kenya: Public notice on the Virtual Asset Service Providers Act 2025, 18 November 2025
3. Virtual Asset Service Providers Regulations 2026 (Oraro and Company Advocates copy)
4. S. Nnyaga Advocates: Kenya VASP Regulations 2026, licensing and capital
5. Vellum: Kenya's virtual asset regime enters compliance phase

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.