Legal Alert: Key Updates In The Virtual Asset Service Providers Bill, 2025

Introduction

A major step toward regulating virtual assets and service providers in Kenya was taken on March 17, 2025, when the Government of Kenya published the Virtual Asset Service Providers (VASPs) Bill, 2025 in the Kenya Gazette Supplement No. 53 (National Assembly Bills No. 15). The 2024 draft version that was previously distributed for stakeholder input has significant improvements and additions in this gazetted version.

This alert highlights key modifications from the 2024 draft and their implications for businesses operating in or entering Kenya’s virtual asset market.

A. New and Expanded Definitions and Provisions

There are now definitions for new terms like “anonymity enhancing services”, “custodial wallet," "mixer or tumbler services," and "stablecoins."

Anonymity enhancing services have been defined as offering, facilitating or executing transactions in digital assets with the intention of concealing information. Mixer or tumbler services have been defined as cryptographic facilities or services that mix different streams of potentially traceable virtual assets, concealing the origin of funds of a particular virtual asset. Both anonymity enhancing services and mixer or tumbler services are prohibited by the revised Bill. These additions reflect a stronger position against transactions that may obscure the origin or destination of virtual asset transactions. These new definitions aim to prohibit the conducting of transactions using digital assets to conceal fraudulent transactions, hence curbing the use of virtual assets to conceal proceeds of crime.

The revised Bill provides that virtual assets wallets now fall under the regulation of the Central Bank of Kenya (CBK) while virtual assets investments, exchanges and token platforms fall under the regulation of the Capital Markets Authority (CMA).

Stablecoins are designated to be regulated by the CBK, whereas initial coin offerings (ICOs) will fall under the regulatory oversight of the CMA.

Additionally, the revised Bill introduces provisions for token issuance platforms for the issuance and secondary trading of real assets.

B. Stricter licensing requirements

Previously, licensees were only required to maintain a registered address, now, they must maintain a physical office in Kenya. A registered address can be a virtual location e.g., a lawyer’s or company secretary’s office with no operational presence. By requiring a physical office, regulatory authorities can conduct on-site inspections, verify books of accounts, systems and infrastructure, enforce AML/CFT obligations and verify that the licensee is not just registered but is actually conducting business hence deterring operators with no real-world presence.

The revised Bill has increased the Board composition to a minimum of three (3) directors, all of whom must be natural persons, up from two (2) directors that was required in the previous Bill. Under the previous Bill, board members of VASPs were restricted from serving on more than one board, which was quite limiting especially in a small but growing sector like virtual assets. The revised Bill now allows board members to serve on up to two boards of licensees, striking a better balance between governance flexibility and regulatory oversight.

C. New Compliance Requirements

VASPs will now risk their licenses being suspended, varied or revoked if the relevant regulatory authority finds that the virtual asset service or product offered is being marketed or advertised in a manner that is fraudulent or misleading. This includes situations where promotional materials create false impressions of security, returns or fail to disclose the risks associated with the product or service. This addition helps to guarantee that users and investors make educated decisions and that the public's confidence in Kenya's digital financial ecosystem is maintained by giving regulators the authority to take action against deceptive advertising. Additionally, it discourages dishonest operators from luring gullible users into risky or fraudulent schemes with flashy or false promotions.

The revised Bill has raised penalties for non-compliance to Kshs. Three (3) Million for individuals and Kshs. Ten (10) Million for Companies.

The revised Bill has included a new clause which mandates VASPs to comply with the Data Protection Act, 2019, reinforcing Kenya's commitment to personal data protection in the digital finance space. The revised Bill has also introduced additional reporting requirements for a VASPs CEO. When the CEO learns of or has reason to suspect a material change in the business, such as a change in banking arrangements or a likely change in share or trust ownership, they must promptly notify the appropriate regulatory body in writing. Notifying authorities about these changes ensures that consumers are protected from potential risks arising from shifts in the VASP's operations or ownership, thus maintaining trust and stability in the virtual asset market.

Virtual Asset Service Providers (VASPs) now have an additional obligation under the amended bill to keep their clients' virtual assets separate from both their personal assets and any other non-client assets. In order to prevent any mingling of client assets with the VASP's proprietary holdings or with assets belonging to other clients, VASPs must make sure that client assets are properly identified and kept in distinct accounts or wallets. This requirement is justified by the need to protect clients' interests by guaranteeing that their assets are safeguarded in the event of the VASP's fraud, insolvency or operational failure. Additionally, segregation encourages accountability and transparency, making it simpler to track and retrieve client assets when necessary.

After the revised Bill is signed into law, existing VASPs will have 12 months instead of just six months to comply with its provisions.

Next Steps

The Bill is currently before the National Assembly and may be subject to further amendments during the legislative process. Once enacted, transitional provisions will apply to existing service providers.

How can we help?

The Corporate and Commercial Business Unit at CM Advocates LLP is well versed in matters relating to business set-up advisory, Fintech and related regulations. Our expertise includes registration of companies and licensing, post-incorporation services, regulatory compliance, corporate governance, contract drafting and review.

commercial@cmadvocates.comShould you have any questions on this or any other matter, please do not hesitate to contact commercial@cmadvocates.com, Maureen Odongo at modongo@cmadvocates.com or Magdaline Njeru at mnjeru@cmadvocates.com