Kenya's Virtual Asset Service Providers Act 2025: What It Means for Virtual-Asset Businesses

Kenya's Virtual Asset Service Providers Act 2025 establishes a framework for licensing and supervising businesses that provide virtual asset services. The Act was assented to on 15 October 2025 and came into force on 4 November 2025. Its implementation is supported by the Virtual Asset Service Providers Regulations 2026, published as Legal Notice No. 134 on 22 July 2026.

For a business operating in this sector, the applicable requirements depend on the services it provides and the role it plays in its customers' transactions. A company may describe itself as a software platform while also holding customer assets, facilitating transfers or operating an exchange. Those activities determine its regulatory position, regardless of the description used in its marketing.

Identifying the regulated activity

Section 2 of the Act defines a virtual asset as a digital representation of value that can be digitally traded or transferred and used for payment or investment. It excludes digital representations of fiat currencies, securities and other financial assets from that definition, making the legal classification of the product an important part of determining the applicable framework.

The First Schedule covers activities including wallet services, exchanges, payment processing, brokerage, investment advice, asset management and virtual asset offerings. It also allocates regulatory responsibility between the Central Bank of Kenya and the Capital Markets Authority. Where a business combines several functions, the scope of its authorisation needs to account for each regulated activity, including any involvement of both authorities.

The exclusions in section 4 require the same attention to the product's operation. A token used within a game or loyalty programme may appear to form part of a closed ecosystem, but its transferability, permitted uses and ability to be exchanged outside that ecosystem affect whether the statutory exclusion applies. Describing a product as a utility token or a closed-system credit does not, by itself, resolve that question. These distinctions follow from the Act's definitions, exclusions and allocation of regulated activities.

The Regulations also extend the analysis beyond physical location. Regulation 4 applies to services offered in or from Kenya and includes providers that actively solicit or target local consumers, or derive economic benefit or income from Kenya, even without a physical presence in the country. An overseas platform's relationship with Kenyan customers can therefore bring it within the framework.

The licensing requirements

Section 8 permits a company limited by shares registered under the Companies Act, or a foreign company limited by shares registered under that Act, to apply for a license. This requirement concerns eligibility to conduct a regulated service business and should not be interpreted as a general prohibition on individuals owning virtual assets.

Meeting the company-registration requirement is one part of a wider licensing assessment. The applicant's proposed services, ownership and management, financial resources and operational controls must also be considered against the requirements for the activities it intends to undertake. Regulation 6 gives substance to that assessment through supporting information and documents, including the business plan, ownership details, policies, systems and evidence of capital.

For a technology business, this creates a close connection between the legal application and the design of the service. A description of how customer assets will be protected, for example, needs to reflect the people who can access them, the systems through which transfers occur and the controls governing those transfers. Inconsistencies between the application and the proposed operation can raise questions about the business's readiness to provide the service.

The resulting license must cover the activities undertaken. Company registration, submission of an application and grant of a license are separate stages, and eligibility to apply does not itself authorise a business to begin providing regulated services.

Protecting customers and maintaining operations

Section 24 sets out continuing obligations covering matters such as fair conduct, adequate resources, conflicts of interest, customer-asset protection and accurate advertising. It also addresses anti-money-laundering, counter-terrorism-financing and counter-proliferation-financing requirements, alongside business continuity and complaints handling. Compliance therefore continues throughout the operation of the business after a license has been obtained.

For a provider holding customer assets, these obligations have direct consequences for its internal arrangements. The authority to approve transfers, the reconciliation of customer holdings and the separation of customer assets from the provider's own resources all affect whether those assets are adequately protected. Written policies need to correspond with controls that work within the platform and the organisation responsible for it.

The same relationship between legal commitments and operational capability applies to customer communications. Statements about security, liquidity, returns or regulatory status need to describe the service accurately, while risk disclosures should explain the exposure associated with the product. A promise of immediate withdrawals, for instance, carries implications for the provider's custody arrangements, available assets and reliance on third-party infrastructure.

Personal-data protection is also part of the framework. Section 46 requires any person processing personal data under the Act to comply with the Data Protection Act. Customer-identification records, wallet information and transaction histories can involve identifiable individuals, bringing questions about lawful processing, access, retention and disclosure into the provider's operations. Where overseas service providers handle that information, the relevant contractual arrangements and cross-border transfer requirements also need consideration.

A compromised private key, prolonged platform outage or failure of a critical supplier can affect both access to customer assets and the provider's ability to meet its obligations. Business-continuity and incident-response arrangements should therefore explain how operations will be restored, who has authority to act and how affected customers will receive accurate information. Regulation 21 expressly requires formalised business-continuity and incident-response plans approved by the licensee's board.

Penalties and the transition period

Section 8 prohibits carrying on, purporting to carry on or holding oneself out as carrying on an unlicensed virtual asset service business in or from Kenya. Contravention is an offence under section 8(3), with penalties prescribed by section 40(3). Upon conviction, an individual may face a fine of up to KES 10 million, imprisonment for up to five years, or both. A company may face a fine of up to KES 25 million.

Those figures represent the maximum statutory penalties applicable upon conviction for the relevant offences and should not be construed as automatic penalties for every compliance failure. Other offences and breaches have their own consequences, and section 39 separately gives the regulators administrative enforcement powers. The legal exposure therefore depends on the particular conduct and the provision engaged.

For persons already providing virtual asset services when the Act commenced, section 47 requires compliance within one year of commencement. Calculated from 4 November 2025, the one-year anniversary is 4 November 2026. The provision requires compliance with the Act and does not expressly state that submitting an application alone satisfies that obligation or grants an automatic license.

A business's position under the transition provision depends on when it began providing the relevant services and how its activities fall within the framework. A new entrant should not assume that the arrangement for existing providers authorises it to operate without a license.

In assessing a provider's readiness, I would consider how its proposed services, contractual commitments and technical arrangements fit together. A platform promising customers access to their assets needs custody and withdrawal arrangements capable of supporting that promise, together with terms that accurately explain the service and its limitations. Changes to the product, its suppliers or its operating model can alter that position and create a need for further legal assessment.

Our technology-law practice advises on the licensing, contractual, data-protection and governance questions arising from virtual-asset services. You can contact our team to discuss how the framework applies to your proposed or existing business.