The Virtual Asset Service Providers Regulations, 2026

Implications of the new licensing, capital, governance and conduct rules  

At a glance 

• Kenya now has a complete legal framework for virtual assets. The Regulations, made pursuant to Section 49 of the Virtual Asset Service Providers Act, 2025, provide for the licensing, prudential, governance, conduct and enforcement mechanisms applicable to virtual asset service providers.  

• The Central Bank of Kenya (CBK) shall supervise payment-facing virtual asset activities and stablecoin issuance while the Capital Markets Authority (CMA) shall supervise trading, offering and investment activity. Providers with mixed business models shall be under the ambit of both regulators. 

• Any business that targets Kenyan consumers or derives economic benefit or income from Kenya, whether or not it has an office, staff or an entity shall be required to comply with the Regulations.  

• All existing virtual asset service operators have until 4 November 2026 to comply with the Regulations.   

Background 

The Virtual Asset Service Providers Regulations, 2026 (the Regulations) were made by the Cabinet Secretary for the National Treasury on 3 July 2026 and gazetted on 22 July 2026 as Legal Notice No. 134 of 2026. Read with the Virtual Asset Service Providers Act, 2025 (the Act), they establish how virtual asset businesses are licensed in Kenya and how they must be capitalised, governed, staffed, secured and supervised once licensed. 

The practical effect is that market entry, prudential standing, governance, technology risk and financial crime controls are now assessed together in a single exercise.  

For most businesses the first question is not “how do we apply?” but “what exactly are we, and to whom do we answer?” Classification turns on the substance of the service and not the label on the product. 

1. Who does the Regulations apply to? 

The Regulations apply to any person offering virtual asset services in or from Kenya. Critically, a person is treated as operating in or from Kenya where that person targets or solicits Kenyan consumers or derives an economic benefit or income from Kenya, regardless of any physical presence in the country.  

This test captures offshore exchanges and platforms that onboard Kenyan customers, market into Kenya, earn fees from Kenyan activity or settle Kenyan transactions.  

The full spectrum of activities or licensees within the Regulations include wallet providers, virtual asset exchanges, virtual asset payment processors, virtual asset brokers, virtual asset investment advisors, virtual asset managers, virtual asset offering providers, initial coin offering (ICO), virtual asset tokenization and stablecoin issuance.  

An applicant must be incorporated in Kenya or registered here as a foreign company. 

2. Who regulates which activity? 

There is no single regulator. Supervisory responsibility between CBK and CMA is allocated by activity, broadly between payment-facing activity on the one hand and market- and investment-facing activity on the other. 

3. License application 

The application is documentation-heavy by design. Applicants must submit, at a minimum: 

• a detailed business plan setting out the proposed activities, organisational structure, financial projections, ownership and beneficial ownership; 

• fit and proper forms, in the format prescribed in the Fourth Schedule, for directors, chief executive officers, senior officers, significant shareholders and beneficial owners; 

• proof of source of funds; 

• operational policies covering risk management, anti-money laundering, counter-financing of terrorism and counter-proliferation financing (AML/CFT/CPF), cybersecurity, custody, conflicts, outsourcing and complaints handling; 

• a description of systems and controls, evidence of adequate human and technology resources, and evidence of paid-up and liquid capital; and 

• audited financial statements for the preceding three years, or opening financial statements where the applicant is newly incorporated. 

The relevant authority may require interviews and may reject an application for non-responsiveness, weak AML/CFT capability, governance failings, adverse compliance history or public interest concerns. Where documentation and due diligence are complete, the authority is expected to determine the application within thirty days. Licences are renewed annually. 

4. Commencement of operations after licensing 

Regulation 8 requires a licensee to commence its virtual asset business within twelve months of the grant of the licence. This implies that a licence obtained early and left dormant while funding or product work continues is a regulatory exposure. 

Additionally, Regulation 13 prevents a licensee from transferring or assigning its licence unless it has commenced business, held the licence for at least thirty-six months from commencement, and otherwise complied with the Regulations. This should be factored into acquisitions, disposals, group reorganisations and investor exit planning, because a licence cannot simply be sold on with the business in the first three years. 

5. Capital, liquidity and fees 

The Fifth Schedule tiers both paid up and liquid capital by activity as follows: 

Liquid capital is set separately for each category, generally as the higher of a fixed sum or a percentage of liabilities. Stablecoin issuers must hold the higher of KES 60 million or 100% of current liabilities for at least thirty days and wallet providers the higher of KES 30 million or the same liabilities test. Exchanges, on the other hand, must hold the higher of KES 20 million or 8% of total liabilities; and ICO providers the higher of KES 4 million or 8% of total liabilities. Because the test is expressed by reference to liabilities, the requirement grows with the book and should be modelled dynamically against projected volumes. 

Where a licensee is authorised for more than one activity, it must hold the paid-up capital applicable to the highest-capital category, plus fifty percent of the paid-up capital prescribed for each additional activity. 

The various fees that virtual asset service providers must take note of are as follows: 

• For virtual asset managers, the application fee is KES 50,000 and for virtual asset managers the same is KES 10,000. 

• As for the Licence fees, they range from KES 100,000 for brokers to KES 2,000,000 for stablecoin issuers.  

• Renewal fees apply separately and for categories such as exchanges and virtual asset managers are linked to turnover or assets under management. For most licensees in those categories this will be the largest recurring regulatory cost. The exchange renewal fee is the higher of KES 500,000 or 0.5% of the previous year’s gross revenue. 

• ICO and tokenisation approvals attract a fee of 0.25% of the value of the successful offer, subject to a minimum of KES 200,000 and a cap of KES 30,000,000. 

6. Governance, ownership and control 

The board of a virtual asset service provider must have at least three members, of whom at least one-third must be independent directors and no more than one-third may be related to any director.  

The chairperson may not also serve as chief executive officer and the chief executive officer must be domiciled in Kenya. The board must collectively hold the financial, legal, compliance, risk and technology competence appropriate to the licensed activity. 

A significant shareholder is a person holding, directly or indirectly, more than 10% of a licensee’s share capital. Under the Regulations, ownership changes are subject to control to some extent. Acquisitions, transfers or disposals of 10% or less require prior written notification to the relevant authority, while transactions exceeding 10% require prior approval, assessed by reference to the suitability of the proposed acquirer, its ability to conduct the business over the long term and the manner in which the transaction is financed.  

The implication of the above is that investments should be reviewed against these thresholds, and completion mechanics in any transaction involving a licensee must accommodate a regulatory approval step. 

7. Stablecoins and tokenised real-world assets 

Stablecoin issuance is subject to a distinct and considerably more prescriptive regime administered by the Central Bank of Kenya. Among other requirements: 

• issuance requires CBK approval supported by a white paper; 

• stablecoins must be fully backed by segregated qualifying reserve assets at least equal to the value of stablecoins in issue; 

• at least 30% of issuance proceeds must be held in segregated trust accounts with commercial banks in Kenya for issuance and redemption; 

• holders must have redemption rights at par value generally within two working days; 

• issuers may not pay interest or similar returns to stablecoin holders; 

• custody, reserve management, audit, disclosure and reporting obligations apply continuously, including quarterly reserve stress testing; and 

• the CBK may direct licensed intermediaries to restrict access to, or trading in, stablecoins issued outside Kenya where it considers this necessary for financial stability or consumer protection. 

The Regulations also create a separate licensing route for the tokenisation of real-world assets, with tailored capital, governance, disclosure and reporting requirements. The tokenisation activity is licensed in its own right and the offering may also require approval. 

8. Customer protection, conduct and advertising 

Licensees will be required to make pre-transaction disclosures covering licence status, services offered, risks, fees, conflicts of interest, withdrawal and cancellation procedures, security protocols, business continuity measures and material operational changes.  

They must communicate fairly, clearly and accurately, and maintain effective complaints procedures. Customer assets must be safeguarded and segregated from the licensee’s own assets and from the claims of its creditors, consumer service agreements must be clear, and contractual dilution of a licensee’s duties to consumers is prohibited. Records must generally be retained for seven years. 

Insider trading, market manipulation, false trading, fraudulent inducement, front-running, churning and cold calling are prohibited and exchanges must conduct admission due diligence on listed assets.  

Advertising shall be subject to content rules, limits on performance information, fee disclosure, mandatory risk warnings and restrictions on internet marketing, and oversight must extend across websites, apps, white papers, social media, affiliates and influencer arrangements. 

9. Financial crime, cybersecurity and resilience 

The Regulations impose stringent requirements to address financial crimes, cybersecurity and resilience issues. AML/CFT/CPF frameworks must be risk-based and address customer and beneficial owner verification, enhanced due diligence, PEP and sanctions screening, transaction monitoring, suspicious transaction reporting, record keeping and source of funds. 

Originator and beneficiary information must accompany transfers and controls should be calibrated to high-risk wallets and sanctions exposure.  

Licensees must also maintain proportionate technology and cybersecurity controls, including a board-approved strategy, secure access and cryptographic key management, vulnerability and penetration testing, independent audits, incident reporting, business continuity, disaster recovery and oversight of outsourced service providers. 

10. Supervision and enforcement 

The relevant authority may inspect, require information and records, conduct investigations, intervene in management, appoint a statutory manager, issue freezing and seizure orders, give remedial directions, suspend or revoke a licence and oversee voluntary and involuntary liquidation. 

The Regulations also establish a Virtual Assets Services Coordination Forum chaired by the National Treasury, drawing together close to twenty regulators and government agencies, including the Central Bank of Kenya, the Capital Markets Authority, the Asset Recovery Agency, the Ethics and Anti-Corruption Commission, the Financial Reporting Centre, the Directorate of Criminal Investigations, the National Intelligence Service, the Office of the Director of Public Prosecutions and the Kenya Revenue Authority. 

11. The transition: 4 November 2026 

Section 47 of the Act gave persons already providing virtual asset services one year from the Act’s commencement to comply. The Act commenced on 4 November 2025, which fixes 4 November 2026 as the deadline.  

There is no sandbox and no transitional relief. This means that pre-existing operators are not grandfathered and must meet the full requirements. That leaves a short runway for restructuring ownership, incorporating locally, raising qualifying capital, recruiting independent directors, producing audited financial information, completing security testing and assembling the required evidence. 

Businesses that took positions on the March 2026 draft should also revisit them since several proposals did not survive into the gazetted text.  

How CM Advocates LLP can assist 

Our Digital Assets, Cryptocurrencies & Blockchain Practice advises virtual asset providers, fintechs, financial institutions, issuers, investors and technology businesses across the full licensing exercise. We advise on: 

• regulatory perimeter assessments, activity classification and licence strategy, including identifying the correct regulator for multi-activity models; 

• readiness reviews testing ownership, governance, capital and controls against the Regulations, producing a prioritised, costed remediation plan; 

• preparing and assembling CBK and CMA applications, reviewing business plans, fit and proper submissions and supporting evidence and managing regulator queries and interviews; 

• entity establishment, ownership and cross-border structuring, board composition, investment documentation and approvals for changes in control; 

• stablecoin reserve, trust and custody arrangements, white papers, redemption terms and ICO and tokenisation approvals; 

• AML/CFT/CPF, sanctions, consumer protection, market conduct, advertising, data protection, cybersecurity and operational resilience frameworks, together with the supporting tax, financing, technology, intellectual property, employment and outsourcing arrangements; and 

• regulatory investigations, cyber incidents, blockchain tracing, asset recovery and disputes. 

Our multidisciplinary team combines financial regulatory, corporate, tax, technology, data, employment and dispute resolution capability across East Africa. If you would like a scoping conversation or a readiness review mapped to the 4 November 2026 deadline, we would be glad to assist. 

Written by: 

Brandon Otieno – Senior Associate (botieno@cmadvocates.com)  

Cyrus Maina – Managing Partner (cmaina@cmadvocates.com)  

Contact us 

Digital Assets, Cryptocurrencies & Blockchain Practice: dacb@cmadvocates.com  

CM ADVOCATES LLP 

Head Office – Nairobi 
I&M Bank House, 7th Floor 
2nd  Ngong Avenue 
Nairobi, Kenya 
E: law@cmadvocates.com 

Mombasa Office 
Links Plaza, 3rd Floor 
Links Road, Nyali 
Mombasa, Kenya 
E: mombasaoffice@cmadvocates.com 

Regional Presence 

Uganda | Tanzania | Rwanda | Zambia | Ethiopia | South Sudan