Crypto Licence in Kenya: CBK or CMA Under the VASP Act

Kenya licenses crypto businesses now. Since 4 November 2025, any business providing virtual asset services in or from Kenya needs a licence under the Virtual Asset Service Providers Act, No. 20 of 2025. The detailed rules followed in July 2026 as the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134), and businesses that were already operating when the Act commenced have until 4 November 2026 to comply.

Much of what a foreign founder still finds online describes Kenya as an unregulated crypto market. That is now wrong, and acting on it is a criminal offence carrying a fine of up to KES 25 million for a company.

The short answer

• A licence is required for exchanges, custodial wallets, brokers, payment processors, asset managers, investment advisers, token offerings, tokenisation platforms and stablecoin issuers operating in or from Kenya.
• Two regulators share the work. The Central Bank of Kenya licenses wallets, payment processing and stablecoin issuance. The Capital Markets Authority licenses exchanges, trading platforms, brokers, managers, advisers, token offerings and tokenisation.
• Licences are granted activity by activity, so a single business model can need licences from both regulators.
• Minimum paid-up capital runs from nil for an investment adviser to KES 300 million, about US$2.3 million, for a stablecoin issuer.
• Only an entity registered under Kenya's Companies Act can apply. The company comes first and the licence second.
• The regulator has 30 days to decide a complete application, and a licence expires on 31 December of the year it is granted, whatever the date of grant.

What changed, and when

The Act was assented to on 15 October 2025, published in the Kenya Gazette on 21 October 2025, and commenced on 4 November 2025. Its object, set out in section 3, is to license and regulate virtual asset service providers "in and from Kenya". Section 5 designates the Capital Markets Authority and the Central Bank of Kenya as the regulators, and leaves room for the Cabinet Secretary to gazette others.

The National Treasury published draft regulations for public comment in March 2026. The final Virtual Asset Service Providers Regulations, 2026 were gazetted as Legal Notice No. 134 in Kenya Gazette Supplement No. 185 of 22 July 2026.

Are you caught?

The test is whether you carry on virtual asset services in or from Kenya (sections 4(1) and 8(2)). A Nairobi entity that serves only offshore clients is still providing services from Kenya, and it is still inside the Act.

Section 8(2) also prohibits holding yourself out as providing virtual asset services without a licence. A launch announcement, a website inviting Kenyan users onto an exchange, or a pitch circulated to Kenyan customers before the licence is granted can each fall on the wrong side of that line.

What the Act leaves out

Section 4(2) excludes three things:

• Closed-ecosystem tokens that meet all five of the Act's conditions: not transferable outside the ecosystem, not exchangeable for real-world goods or services outside it, not tradeable on a secondary market, usable only for the issuer's own defined purposes and not for payment or investment, and not exchangeable for fiat currency or other virtual assets.
• Central bank digital currencies, whether issued by the Central Bank of Kenya or by another jurisdiction's central bank.
• Non-fungible tokens that are not used for payment, investment or other financial purposes.

The five closed-ecosystem conditions are cumulative. A token that fails any one of them is back inside the Act.

Section 4(3) also provides that virtual service tokens are not virtual assets, so a business dealing only in them needs no licence.

Which regulator: CBK or CMA

The First Schedule to the Act allocates each licensable activity to one regulator.

The Central Bank takes what is closest to money and custody. The Capital Markets Authority takes markets, investment and issuance.

Licences are granted per activity (sections 9(1) and 10(1)), so a business model that crosses the line needs both regulators. The obvious case is an exchange that also issues its own stablecoin. The exchange is licensed by the CMA and the stablecoin by the CBK, so the company carries two licences, two sets of conditions and two supervisors. The Act does not say whether the two applications run jointly or in parallel, and that is worth settling with both regulators before you file.

How much capital each licence needs

The Regulations set a minimum paid-up capital for each licence category. Dollar figures are at KES 129.4 to the US dollar (September 2026).

These are paid-up figures, not authorised capital.

Capital stacks, at a discount. A business holding more than one licence needs the full paid-up capital of its highest category plus 50% of the capital for each additional activity. The exchange that also issues a stablecoin needs KES 300 million for the stablecoin and KES 50 million for the exchange: KES 350 million, about US$2.7 million.

Liquid capital is a separate test. Each category also carries a liquid-capital floor. For a stablecoin issuer it is KES 60 million or 100% of current liabilities for at least 30 days, whichever is higher.

The fees are modest by comparison. The application fee is KES 100,000 for most categories, KES 50,000 for a virtual asset manager and KES 10,000 for an investment adviser. Licence fees run from KES 50,000 for an investment adviser to KES 2,000,000 for a stablecoin issuer. Approving a token offering costs 0.25% of the value of the successful offer, with a floor of KES 200,000 and a cap of KES 30 million.

The stablecoin question

The Act excludes "digital representation of fiat currencies" from its definition of a virtual asset (section 2), and section 4(2)(b) excludes fiat currency issued by a central bank. Read quickly, those two provisions suggest that a stablecoin backed one-for-one by US dollars or Kenya shillings is simply a digital representation of fiat, and outside the Act.

It is not, for three reasons. Section 4(2)(b) is confined to instruments issued by central banks, not by private issuers. Section 2 separately defines a stablecoin as a virtual asset designed to keep its value fixed or pegged to one or more reserve assets, expressly including fiat currency. And the First Schedule makes stablecoin issuance a licensable activity in its own right, which would be pointless if fiat-backed coins sat outside the Act.

The Regulations give stablecoin issuers the highest capital floor in the regime. Every coin in issue must be fully backed by reserve assets, holders must be able to redeem at par, and the issuer may not pay interest or similar returns on the coin.

The company comes first

Section 8(1) limits eligibility to a company limited by shares registered under the Companies Act, or a foreign company limited by shares registered under it. An individual, a partnership, or an offshore entity that has not registered in Kenya cannot hold the licence.

That gives a foreign group two ways in:

• A Kenyan subsidiary. This is the route most entrants take. We handle setting up a foreign-owned company in Kenya as the first stage of this kind of engagement, with the share capital sized to the licence from the start rather than increased later.
• A registered branch of the foreign parent. The Act admits it, and opening a branch of a foreign company is a recognised route into Kenya. How a branch evidences paid-up capital that belongs to its parent is a question to settle with the regulator before you choose it.

Eligibility turns on corporate form, not on the nationality of the owners. Not every Kenyan licence allows that: a recruitment agency must have at least one Kenyan shareholder.

Section 243 of the Companies Act requires a private company with paid-up capital of KES 5 million or more to have a secretary, so every licence category with a capital floor carries a company secretary from the outset. Section 24(h) of the VASP Act also requires the licensee to open and operate a Kenyan bank account, which makes the corporate bank account a statutory step rather than a convenience.

What the regulators will ask of you

• A board of at least three directors, at least three of them natural persons (section 20(1)), none of whom may sit on more than two licensees' boards. The Regulations add that at least one third must be independent and no more than one third may be related to another director.
• A chief executive in Kenya. Section 30 requires a chief executive responsible for day-to-day management in Kenya, appointed with the regulator's prior approval, and the Regulations require the chief executive to be domiciled in Kenya. If the right person is a foreign national, they will need a work permit, which the Directorate of Immigration Services issues: the Class D employment permit when the company employs them, or the Class G investor permit when they are also investing in the business.
• Fit-and-proper vetting that reaches the owners (sections 11, 18 and 32(2)(a)): directors and senior officers, and also significant shareholders and beneficial owners.
• A physical office in Kenya where the business is carried on (section 19). A registered office address does not satisfy this.
• Anti-money-laundering obligations in full. The Second Schedule amends the Proceeds of Crime and Anti-Money Laundering Act so that a licensed provider is a reporting institution.
• Cyber security measures under the Computer Misuse and Cybercrimes Act (section 28), and a flat prohibition on mixers, tumblers and other anonymity-enhancing services (section 21(1)(a)).
• Client assets segregated from the company's own, and out of reach of its creditors (section 31).
• Records kept for seven years at the principal place of business, with the regulator entitled to real-time, read-only access (section 44).
• Audited accounts filed within three months of the financial year end (section 29).

Once all of that is in the file, the Regulations give the regulator 30 days to determine a complete application. The clock starts only when the file is complete and due diligence is done. A granted licence must be gazetted within 30 days (section 10(7)), and each regulator keeps a public register of licensees on its website (section 17).

What getting it wrong costs

Under section 41, directors, partners and senior officers who knowingly authorised, permitted or aided an offence are personally liable for it.

Three obligations that surprise corporate groups

The licence expires on 31 December. Under section 13, a licence expires at the end of the calendar year in which it is issued, whenever in that year it is granted. A licence granted in November needs renewing within weeks, and renewal is annual from then on.

Your parent company's decisions may need Kenyan approval. Section 27 prohibits issuing, transferring or disposing of shares in a licensee without regulatory approval, and the prohibition extends to beneficial interests. A group reorganisation that changes who ultimately owns the Kenyan licensee can therefore need sign-off in Nairobi. Section 26 requires a prior no-objection for material changes, including a change of business plan, directors or senior officers, trade name, domain name, principal place of business or target market, as well as mergers, acquisitions and outsourcing.

The regulator can look upstream. Section 37(2) lets the regulator require information from the parent company, subsidiaries, associates and any holder of 10% or more, and section 32(2)(d) provides for consolidated supervision of the licensee and its group.

A token offering also needs its own written no-objection before issuance (section 34), separate from the entity licence, and a natural person may not issue or promote one.

If you already operate in Kenya: 4 November 2026

Section 47 gave anyone already providing virtual asset services when the Act commenced one year to comply, until 4 November 2026. After that date, operating without a licence is the section 8(3) offence in the table above.

The window was for businesses already operating on 4 November 2025, so a business that launched after that date should not assume it is sheltered. Treat 4 November 2026 as the date by which you need to hold the licence, not merely to have applied. With a 30-day decision period that only starts once the file is complete, the practical cut-off for filing falls well before November.

The order to do this in

1. Map your model against the First Schedule. List every activity and match it to a licence and a regulator. That sets the capital, the fees and whether you answer to one supervisor or two.
2. Size the capital, including 50% for each additional activity, and plan for the liquid-capital test as well as the paid-up figure.
3. Form the company with paid-up share capital sized to the licence, and appoint the company secretary the Companies Act will then require.
4. Build the governance: at least three directors with a third of them independent, a chief executive domiciled in Kenya, and a work permit if that person is a foreign national.
5. Take a real office and open the Kenyan bank account.
6. Prepare the fit-and-proper files for every director, senior officer, significant shareholder and beneficial owner, alongside the anti-money-laundering, cyber-security and record-keeping frameworks.
7. File, and say nothing publicly until the licence is granted. Section 8(2) catches holding out.

---

We advise international groups on entering the Kenyan market and coordinate the company formation, structuring and licensing work that follows. If you are planning a virtual asset business in or from Kenya, talk to us before the company is formed.

This article states the position under the Virtual Asset Service Providers Act, No. 20 of 2025, and the Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134), as at September 2026. The regulators are still issuing implementation guidance, and figures change, so confirm the current position before you rely on it. Hodari Ventures is an independent advisory firm, not a government agency or a regulator.